Struct Redactor

Source

pub struct Redactor { /* private fields */ }

Expand description

Configurable redaction builder for secrets and legacy field names.

Redactor encapsulates redaction policy, custom secret field names, and exact legacy URL field names. Build with Redactor::new(), configure via builder methods, then pass to redaction functions like redacted_value or redact_url_secrets.

Implementations§

Source §

impl Redactor

Source

pub fn new() -> Self

Create a new default redactor (full redaction, no custom secret names).

Source

pub fn secret_names<I: IntoIterator<Item = S>, S: Into<String>>( self, names: I, ) -> Self

Set custom field names to treat as secrets in addition to _secret suffixes.

Matching is exact field-name equality at any nesting level. The same list also matches URL query-parameter names inside _url fields. Builder style: returns self.

Source

pub fn url_names<I: IntoIterator<Item = S>, S: Into<String>>( self, names: I, ) -> Self

Set exact legacy field names whose values should receive URL-aware redaction in addition to _url/_URL suffixed fields.

A matching string is handled like an _url value. Arrays and nested collections recursively apply that treatment to every string leaf. Matching is exact and does not normalize case, whitespace, or spelling.

Source

pub fn policy(self, policy: RedactionPolicy) -> Self

Set the redaction policy (default: full redaction). Builder style: returns self.

Source

pub fn value(&self, value: &Value) -> Value

Redact a JSON value copy using this redactor’s policy and secret names.

Clones value first; for a large payload you already own and can mutate, prefer Redactor::redact_in_place to avoid the copy.

Source

pub fn url(&self, url: &str) -> String

Redact secret components of a URL string using this redactor’s settings.

A query parameter is redacted iff its (form-decoded) name ends in _secret/_SECRET or matches an exact entry in secret_names. A fragment written in the same k=v&k=v shape — how an OAuth implicit-flow response carries its token — is redacted by that same rule; any other fragment passes through byte-for-byte. The userinfo password (scheme://user:pass@host) is always redacted as a structural rule. Only the secret spans are replaced with ***; every other byte is preserved. A string that is not a single, whitespace-free, scheme-prefixed URL (including a URL embedded in surrounding prose) is returned unchanged.

A URL is unscoped input: RedactionPolicy::Off returns it unchanged, every other policy redacts it in full.

Source

pub fn urls_in_text(&self, text: &str) -> String

Redact complete scheme-prefixed URLs embedded in prose.

This is deliberately explicit and independent from structured field redaction. It recognizes URL spans only; it never scans surrounding text for secret-looking names or values.

Source

pub fn redact_in_place(&self, value: &mut Value)

Redact value in place, using this redactor’s policy and secret names.

The zero-copy counterpart of Redactor::value — use it on a large payload you already own to avoid cloning.

Source

pub fn argv<S: AsRef<str>>(&self, args: &[S]) -> Vec<String>

Redact secret values out of a command line, using this redactor’s policy and secret names.

A long flag whose name is secret by AFDATA naming (--api-key-secret, or an exact secret_names entry) has its value replaced by ***, in both --flag=value and --flag value spellings. Everything else is preserved byte-for-byte.

Free text is deliberately never scanned: a bare api_key_secret=sk-live positional, or a secret-looking token after a non-secret flag, is left alone. AFDATA decides sensitivity from the field name, and argv is no exception — rename the flag rather than pattern-matching values. A flag with no value (end of argv, or followed by another flag) is likewise left inspectable.

Only long (--) flags are recognized, matching the convention’s long-flags-only rule.

A command line is unscoped input: RedactionPolicy::Off returns args unchanged, every other policy redacts in full.

Source

pub fn is_secret_name(&self, name: &str) -> bool

True when name would be treated as a secret field name by this redactor: an exact _secret/_SECRET suffix, or an exact match against a configured secret_names entry.

Exposed for callers that must gate on a single targeted field name (for example a CLI dot-path leaf) rather than redact a whole value — Redactor::value only rewrites fields it finds while walking an object, so a bare scalar pulled out from under its field name needs this explicit check instead.

Source

pub fn is_url_name(&self, name: &str) -> bool

True when name receives URL-aware structured-field redaction: an exact _url/_URL suffix or an exact configured url_names entry.

The counterpart to Redactor::is_secret_name, for the same targeted single-field case. Kept even with no in-tree caller: a consumer that gates on one name has to ask both questions, and an API that answers only half of a symmetric pair sends the caller back to reimplementing the suffix rule — which is exactly how the rule drifts.