qubit-redact 0.3.0

Rule-driven redaction for fields, diagnostics, HTTP data, and Rust domain objects
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

// =============================================================================
//    Copyright (c) 2025 - 2026 Haixing Hu.
//
//    SPDX-License-Identifier: Apache-2.0
//
//    Licensed under the Apache License, Version 2.0.
// =============================================================================
//! Built-in groups of sensitive field names.

use super::Sensitivity;

/// Predefined groups of sensitive field names.
#[must_use]
#[non_exhaustive]
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum SensitiveFieldPreset {
    /// Passwords, client secrets, private keys, and secret-like names.
    Credentials,
    /// Connection strings and configuration values that embed credentials.
    CredentialContainers,
    /// API keys, access tokens, refresh tokens, and JWT-like names.
    AuthTokens,
    /// HTTP authentication and cookie fields.
    Http,
    /// Session identifiers and session tokens.
    Session,
}

/// Field names for [`SensitiveFieldPreset::Credentials`].
const CREDENTIALS_FIELDS: [(&str, Sensitivity); 17] = [
    ("password", Sensitivity::Secret),
    ("password_confirmation", Sensitivity::Secret),
    ("passwd", Sensitivity::Secret),
    ("passphrase", Sensitivity::Secret),
    ("pgpassword", Sensitivity::Secret),
    ("secret", Sensitivity::Secret),
    ("client_secret", Sensitivity::Secret),
    ("credential", Sensitivity::Secret),
    ("credentials", Sensitivity::Secret),
    ("private_key", Sensitivity::Secret),
    ("privatekey", Sensitivity::Secret),
    ("security_key", Sensitivity::Secret),
    ("secret_key", Sensitivity::Secret),
    ("secret_access_key", Sensitivity::Secret),
    ("access_key", Sensitivity::High),
    ("accesskey", Sensitivity::High),
    ("access_key_id", Sensitivity::Medium),
];

/// Field names for [`SensitiveFieldPreset::CredentialContainers`].
const CREDENTIAL_CONTAINER_FIELDS: [(&str, Sensitivity); 11] = [
    ("dsn", Sensitivity::Secret),
    ("database_dsn", Sensitivity::Secret),
    ("redis_url", Sensitivity::Secret),
    ("mongodb_uri", Sensitivity::Secret),
    ("mongodb_url", Sensitivity::Secret),
    ("amqp_url", Sensitivity::Secret),
    ("broker_url", Sensitivity::Secret),
    ("http_proxy", Sensitivity::Secret),
    ("https_proxy", Sensitivity::Secret),
    ("all_proxy", Sensitivity::Secret),
    ("docker_auth_config", Sensitivity::Secret),
];

/// Field names for [`SensitiveFieldPreset::AuthTokens`].
const AUTH_TOKEN_FIELDS: [(&str, Sensitivity); 11] = [
    ("api_key", Sensitivity::High),
    ("apikey", Sensitivity::High),
    ("x_api_key", Sensitivity::High),
    ("token", Sensitivity::High),
    ("access_token", Sensitivity::High),
    ("refresh_token", Sensitivity::High),
    ("id_token", Sensitivity::High),
    ("jwt", Sensitivity::High),
    ("jwt_token", Sensitivity::High),
    ("auth_token", Sensitivity::High),
    ("bearer", Sensitivity::High),
];

/// Field names for [`SensitiveFieldPreset::Http`].
const HTTP_FIELDS: [(&str, Sensitivity); 4] = [
    ("authorization", Sensitivity::High),
    ("proxy_authorization", Sensitivity::High),
    ("cookie", Sensitivity::High),
    ("set_cookie", Sensitivity::High),
];

/// Field names for [`SensitiveFieldPreset::Session`].
const SESSION_FIELDS: [(&str, Sensitivity); 3] = [
    ("session", Sensitivity::High),
    ("session_id", Sensitivity::High),
    ("session_token", Sensitivity::High),
];

impl SensitiveFieldPreset {
    /// Returns the built-in field-name and sensitivity pairs in this preset.
    ///
    /// # Returns
    ///
    /// The complete built-in field table for this preset.
    #[inline(always)]
    pub const fn fields(self) -> &'static [(&'static str, Sensitivity)] {
        match self {
            Self::Credentials => &CREDENTIALS_FIELDS,
            Self::CredentialContainers => &CREDENTIAL_CONTAINER_FIELDS,
            Self::AuthTokens => &AUTH_TOKEN_FIELDS,
            Self::Http => &HTTP_FIELDS,
            Self::Session => &SESSION_FIELDS,
        }
    }
}