dx-driven 0.1.0

Professional AI-assisted development orchestrator with binary-first architecture
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

use regex::{Captures, Regex};
use std::sync::OnceLock;

const REDACTED: &str = "[REDACTED]";

pub(crate) fn redact_secrets(value: &str) -> String {
    let redacted = authorization_regex()
        .replace_all(value, |captures: &Captures<'_>| {
            format!("{}{}", &captures["prefix"], REDACTED)
        })
        .to_string();
    let redacted = bearer_regex()
        .replace_all(&redacted, |captures: &Captures<'_>| {
            format!("{}{}", &captures["prefix"], REDACTED)
        })
        .to_string();
    let redacted = flag_regex()
        .replace_all(&redacted, |captures: &Captures<'_>| {
            format!("{}{}", &captures["prefix"], REDACTED)
        })
        .to_string();
    key_value_regex()
        .replace_all(&redacted, |captures: &Captures<'_>| {
            format!("{}{}", &captures["prefix"], REDACTED)
        })
        .to_string()
}

fn authorization_regex() -> &'static Regex {
    static REGEX: OnceLock<Regex> = OnceLock::new();
    REGEX.get_or_init(|| {
        Regex::new(
            r#"(?ix)
            (?P<prefix>\bauthorization\s*:\s*(?:bearer|basic)\s+)
            (?P<secret>[^"'\s&,;|)}]+)
            "#,
        )
        .expect("authorization redaction regex is valid")
    })
}

fn bearer_regex() -> &'static Regex {
    static REGEX: OnceLock<Regex> = OnceLock::new();
    REGEX.get_or_init(|| {
        Regex::new(
            r#"(?ix)
            (?P<prefix>\bbearer\s+)
            (?P<secret>[^"'\s&,;|)}]+)
            "#,
        )
        .expect("bearer redaction regex is valid")
    })
}

fn flag_regex() -> &'static Regex {
    static REGEX: OnceLock<Regex> = OnceLock::new();
    REGEX.get_or_init(|| {
        Regex::new(
            r#"(?ix)
            (?P<prefix>
                --(?:openai-api-key|openai_api_key|api-key|api_key|apikey|access-token|access_token|
                    refresh-token|refresh_token|id-token|id_token|client-secret|client_secret|
                    private-key|private_key|password|token|secret|session|cookie)
                (?:\s+|=)
                ["']?
            )
            (?P<secret>[^"'\s&,;|)}]+)
            "#,
        )
        .expect("flag redaction regex is valid")
    })
}

fn key_value_regex() -> &'static Regex {
    static REGEX: OnceLock<Regex> = OnceLock::new();
    REGEX.get_or_init(|| {
        Regex::new(
            r#"(?ix)
            (?P<prefix>
                ["']?
                (?:openai_api_key|api_key|apikey|access_token|refresh_token|id_token|
                    client_secret|private_key|password|token|secret|session|cookie)
                ["']?
                \s*[:=]\s*
                ["']?
            )
            (?P<secret>[^"'\s&,;|)}]+)
            "#,
        )
        .expect("key-value redaction regex is valid")
    })
}