verificationcache

package
v3.97.9 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 24, 2026 License: AGPL-3.0 Imports: 10 Imported by: 2

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type DetectorMetricsReporter added in v3.97.8

type DetectorMetricsReporter interface {
	// AddDetectorVerifyTimeSpent records wall time spent verifying credentials remotely for one detector. It is not
	// called for results served from the cache.
	AddDetectorVerifyTimeSpent(detectorType detector_typepb.DetectorType, wallTime time.Duration)
}

DetectorMetricsReporter is an optional interface that a MetricsReporter can additionally implement to receive verification timing attributed to the detector that incurred it. Implementations must be thread-safe.

What one sample covers depends on the path taken. When the result cache is consulted, a detectors.ResultVerifier records one sample per remote VerifyResult call on a cache miss. Every other case records one sample per whole FromData(verify=true) pass, including its regex pass: detectors that do not implement detectors.ResultVerifier, targeted rescans (forceCacheUpdate), and a VerificationCache with no result cache. The last two apply to ResultVerifier detectors too, so one such detector can produce whole-pass samples that cover many remote calls alongside its per-call samples. A detector that starts implementing detectors.ResultVerifier shifts its distribution, which resets its baseline rather than signaling a provider change.

type InMemoryMetrics

type InMemoryMetrics struct {
	CredentialVerificationsSaved atomic.Int32
	FromDataVerifyTimeSpentMS    atomic.Int64
	ResultCacheHits              atomic.Int32
	ResultCacheHitsWasted        atomic.Int32
	ResultCacheMisses            atomic.Int32
}

InMemoryMetrics is a MetricsReporter that stores reported metrics in memory for retrieval at the end of a scan.

func (*InMemoryMetrics) AddCredentialVerificationsSaved

func (m *InMemoryMetrics) AddCredentialVerificationsSaved(count int)

func (*InMemoryMetrics) AddFromDataVerifyTimeSpent

func (m *InMemoryMetrics) AddFromDataVerifyTimeSpent(wallTime time.Duration)

func (*InMemoryMetrics) AddResultCacheHits

func (m *InMemoryMetrics) AddResultCacheHits(count int)

func (*InMemoryMetrics) AddResultCacheHitsWasted

func (m *InMemoryMetrics) AddResultCacheHitsWasted(count int)

func (*InMemoryMetrics) AddResultCacheMisses

func (m *InMemoryMetrics) AddResultCacheMisses(count int)

type MetricsReporter

type MetricsReporter interface {
	// AddCredentialVerificationsSaved records "saved" verification attempts, which is when credential verification
	// status is loaded from the cache instead of retrieved from a remote verification endpoint. This number might be
	// smaller than the cache hit count due to cache hit "wasting"; see AddResultCacheHitsWasted for more information.
	AddCredentialVerificationsSaved(count int)

	// AddFromDataVerifyTimeSpent records wall time spent verifying credentials remotely, either in a call to
	// detector.FromData with verify=true or, for detectors that implement detectors.ResultVerifier, in the
	// per-result verification of cache misses.
	AddFromDataVerifyTimeSpent(wallTime time.Duration)

	// AddResultCacheHits records result cache hits. Not all cache hits result in elided remote verification requests
	// due to cache hit "wasting"; see AddResultCacheHitsWasted for more information.
	AddResultCacheHits(count int)

	// AddResultCacheMisses records result cache misses.
	AddResultCacheMisses(count int)

	// AddResultCacheHitsWasted records "wasted" result cache hits. A "wasted" result cache hit is a result cache hit
	// that does not elide a remote verification request because there are other secret findings in the relevant chunk
	// that are not cached. When this happens, the detector's FromData method must be called anyway, so the cache hit
	// doesn't save any remote requests.
	AddResultCacheHitsWasted(count int)
}

MetricsReporter is an interface used by a verification cache to report various metrics related to its operation. Implementations must be thread-safe.

type ResultCache

type ResultCache cache.Cache[detectors.Result]

ResultCache is a cache that holds individual detector results. It serves as a component of a VerificationCache.

type VerificationCache

type VerificationCache struct {
	// contains filtered or unexported fields
}

VerificationCache is a structure that can be used to cache verification results from detectors so that a given credential does not trigger multiple identical remote verification attempts.

func New

func New(resultCache ResultCache, metrics MetricsReporter) *VerificationCache

New creates a new verification cache with the provided result cache and metrics reporter. If resultCache is nil, the verification cache will be a no-op passthrough, although it will still record relevant metrics to the provided metrics reporter in this case.

func (*VerificationCache) FromData

func (v *VerificationCache) FromData(
	ctx context.Context,
	detector detectors.Detector,
	verify bool,
	forceCacheUpdate bool,
	data []byte,
) ([]detectors.Result, error)

FromData is a cache-aware facade in front of the provided detector's FromData method.

If the verification cache's underlying result cache is nil, or verify is false, or forceCacheUpdate is true, this method invokes the provided detector's FromData method with the provided arguments and returns the result. If the result cache is non-nil and forceCacheUpdate is true, the result cache is updated with the results before they are returned.

Otherwise, the detector's FromData method is called with verify=false. The result cache is then checked for each returned result. If there is a cache hit for each result, these cached values are all returned. Otherwise, the detector's FromData method is called again, but with verify=true, and the results are stored in the cache and then returned.

Detectors that implement detectors.ResultVerifier are handled by verifyCacheMisses instead, which verifies only the results that missed the cache rather than re-running the detector over the whole chunk.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL