Struct SensitiveDntSink 

pub struct SensitiveDntSink<P: DntKeyProvider> { /* private fields */ }

Encrypted DNT sink. It has no plaintext fallback and must be explicitly wired.

Implementations

impl<P: DntKeyProvider> SensitiveDntSink<P>

pub fn new( config: SensitiveDntSinkConfig, key_provider: P, ) -> Result<Self, LogError>

Creates the sink; enabling it is an explicit sensitive-logging decision.

Examples found in repository

examples/sensitive_diagnostics.rs (lines 31-42)

fn main() -> Result<(), appcore_log::LogError> {
    let key_id = KeyId::new("example-log-key").map_err(|_| appcore_log::LogError::Encryption)?;

    let provider =
        StaticDntKeyProvider::new().with_key(key_id.clone(), SecretKey::new(demo_key()?));

    // The sink bounds the encrypted snapshot by both bytes and event count.
    let sink = SensitiveDntSink::new(
        SensitiveDntSinkConfig {
            path: std::env::temp_dir().join("appcore-sensitive-log.dnt"),
            application_id: ApplicationId::new("example-log")
                .map_err(|_| appcore_log::LogError::Encryption)?,
            key_id,
            max_bytes: 4096,
            max_events: 8,
            retention: 2,
        },
        provider,
    )?;

    // Sensitive mode must be explicit and has no console or JSONL fallback.
    let mut policy = LogPolicy::default();
    policy.sensitivity = Sensitivity::Sensitive;

    let log = LogDispatcher::new(policy, vec![Arc::new(sink)]);

    log.event(0, "security").verbosity(2).error("diagnostic");

    Ok(())
}

Trait Implementations

impl<P: DntKeyProvider> LogSink for SensitiveDntSink<P>

fn emit(&self, event: &LogEvent) -> Result<(), LogError>

Writes one event or reports a controlled failure.

fn accepts_sensitive(&self) -> bool

Reports whether this sink is an explicitly encrypted sensitive boundary.

fn name(&self) -> &'static str

Stable bounded metric label for this sink implementation.