Module redact 

Canonical string-based URL redaction for diagnostic surfaces (ADR-0051).

String surgery over raw URL bytes: userinfo in every authority window is masked as ***, query/fragment content is replaced with ?[redacted] / #[redacted] sentinels, and the result is capped at 256 bytes on a UTF-8 char boundary. Authority windows are enumerated over maximal runs of / and \ characters: pure-slash runs (the landed // rule) open a window at two or more characters, backslash-bearing runs only behind an RFC 3986 scheme prefix. These helpers never parse — they are the strictest feasible handling for strings that may be malformed or hostile.

Distinct from crate::endpoint_uri::EndpointUri::to_redacted_string, which redacts the catalog-driven authored-URI layer (structured EndpointUri values) and is out of scope here.

Functions

redact_url

Canonical strict redaction of a raw URL string for diagnostic surfaces (ADR-0051, bd rc-eh49): authority windows are enumerated over maximal runs of / and \ characters — a pure-slash run of two or more characters opens a window, a backslash-bearing run opens one only behind an RFC 3986 scheme prefix ([a-zA-Z][a-zA-Z0-9+.-]*:) ending immediately before the run (a single \ additionally needs a scheme of two-plus characters, or a one-character scheme whose candidate window content is credential-shaped) — and each window ends at the next /, ?, or #. A window containing @ carries userinfo, and the bytes from window start through the LAST @ are masked in place as ***@ (over-masking is safe, under-masking is not). Every window is scanned, so credentials cannot hide in a later window behind a benign first one. Everything from the earliest ? or # is dropped; the sentinels compose: each distinct introducer character (? and/or #) that occurs anywhere in the URL appends its matching ?[redacted] / #[redacted] sentinel in first-occurrence order — queries and fragments routinely carry tokens. The result is capped at 256 bytes on a UTF-8 char boundary. There is no URL parser here, so in-place windowed masking is the strictest feasible handling. This is the string layer; crate::endpoint_uri::EndpointUri::to_redacted_string redacts the catalog-driven authored-URI surface instead.

redact_url_fail_closed

Fail-closed variant of redact_url: when any authority window of raw carries an @, the whole string is replaced with [redacted] — a string with an unvalidated authority marker may carry credentials nothing validated, so nothing of it is rendered (deliberate fail-closed over-redaction per ADR-0051). Otherwise identical to redact_url.

redact_url_with_query_allowlist

Broker-style redaction: window-mask userinfo like redact_url, then redact sensitive query params per key while keeping benign ones. A pair whose match key — the raw key single-pass %HH-decoded then lowercased (bd rc-r7v8s) — contains any of sensitive_key_substrings renders as {raw_key}=<redacted> (the key keeps its original encoded bytes), EXCEPT when the raw key’s own single-pass minimal decode (see minimal_decode_pair) is credential-shaped — contains @ and also : or //: then the pair renders as a bare <redacted> and the key never echoes (bd rc-yvjp3, ADR-0076 appendix: key-position credential-shape symmetry — the same predicate the benign-key branch applies to the whole pair; a key such as user%3Asecret%40host embeds the credential user:secret@host and must not render). Well-known broker parameter names never decode to that shape, so the transport-policy diagnostic value below is preserved. Otherwise, if the pair’s minimal_decode_pair output is credential-shaped (contains @ and also : or //), the whole pair is replaced with a bare <redacted>: encoded or literal user:secret@host values must not survive under a benign key, while a lone @ (an email address) keeps the pair visible. Every other pair survives byte-for-byte, because non-secret transport policy in query params (ActiveMQ failover URIs) is the sole diagnostic value of logging the broker URL. Fragments are never echoed: everything from the first # is dropped and replaced with the #[redacted] sentinel. The result is capped at 256 bytes on a UTF-8 char boundary. String-based; no URL parser.

window_has_at_sign

Whether a @ appears in any authority window of raw. Windows come from maximal runs of / and \ characters — the same enumeration the mask uses: pure-slash runs of two or more characters always open a window; backslash-bearing runs open one only behind an RFC 3986 scheme prefix ending immediately before the run. Every run is scanned, so credentials cannot hide in a later window behind a benign first one (http://h/a//user:pass@e/) or behind a scheme-prefixed backslash authority (foo:\u:p@e/), while scheme-less drive and UNC paths stay window-free.