1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
// =============================================================================
// Copyright (c) 2025 - 2026 Haixing Hu.
//
// SPDX-License-Identifier: Apache-2.0
//
// Licensed under the Apache License, Version 2.0.
// =============================================================================
//! Structured serialization for maps classified by their keys.
use std::collections::BTreeMap;
use std::collections::HashMap;
use serde::Serialize;
use serde::Serializer;
use serde::ser::SerializeMap;
use super::budget_serialize::BudgetSerialize;
use super::redact_level_serialize::RedactLevelSerialize;
use super::redact_serialize_scope::admit_collection_items;
use super::redacted_level_serialize_ref::RedactedLevelSerializeRef;
use crate::RedactionPolicy;
use crate::Sensitivity;
/// Internal structured serialization capability for policy-classified maps.
#[doc(hidden)]
pub trait RedactMapSerialize {
/// Serializes a map after classifying each value by its field key.
///
/// # Errors
///
/// Propagates admission or downstream serialization failures.
///
/// # Type Parameters
///
/// - `S`: Downstream serializer defining the success and error types.
///
/// # Parameters
///
/// - `serializer`: Destination receiving the map or absent optional value.
/// - `policy`: Immutable policy classifying values by runtime key.
///
/// # Returns
///
/// The destination result after all emitted data passes shared admission.
fn serialize_redacted_map<S>(&self, serializer: S, policy: &RedactionPolicy) -> Result<S::Ok, S::Error>
where
S: Serializer;
}
/// Generates classified serialization for each supported map and its optional
/// form.
macro_rules! map_redact_serialize {
($map:ty) => {
impl<K, V> RedactMapSerialize for $map
where
K: AsRef<str> + Serialize,
V: RedactLevelSerialize + Serialize,
{
/// Serializes an available map with key classification and
/// cumulative child admission.
///
/// # Errors
///
/// Propagates budget or downstream serialization failures.
///
/// # Type Parameters
///
/// - `S`: Downstream serializer defining the success and error types.
///
/// # Parameters
///
/// - `serializer`: Destination receiving the map or absent optional value.
/// - `policy`: Immutable policy classifying values by runtime key.
///
/// # Returns
///
/// The destination result after all emitted data passes shared
/// admission.
fn serialize_redacted_map<S>(&self, serializer: S, policy: &RedactionPolicy) -> Result<S::Ok, S::Error>
where
S: Serializer,
{
if !admit_collection_items(self.len()) {
return super::redact_serialize_scope::serialize_payload(
serializer,
policy.masking().mask_opaque(Sensitivity::Secret).as_ref(),
);
}
let mut map = serializer.serialize_map(Some(self.len()))?;
for (key, value) in self {
let key_name = key.as_ref();
super::redact_serialize_scope::check_key_bytes::<S::Error>(key_name)?;
map.serialize_key(&BudgetSerialize::new(key))?;
if !policy.is_disabled() {
if let Some(level) = policy.sensitivity_for(key_name) {
map.serialize_value(&RedactedLevelSerializeRef::new(value, policy, level))?;
continue;
}
}
map.serialize_value(&BudgetSerialize::new(value))?;
}
map.end()
}
}
impl<K, V> RedactMapSerialize for Option<$map>
where
K: AsRef<str> + Serialize,
V: RedactLevelSerialize + Serialize,
{
/// Serializes an available map with key classification and
/// cumulative child admission.
///
/// # Errors
///
/// Propagates budget or downstream serialization failures.
///
/// # Type Parameters
///
/// - `S`: Downstream serializer defining the success and error types.
///
/// # Parameters
///
/// - `serializer`: Destination receiving the map or absent optional value.
/// - `policy`: Immutable policy classifying values by runtime key.
///
/// # Returns
///
/// The destination result after all emitted data passes shared
/// admission.
fn serialize_redacted_map<S>(&self, serializer: S, policy: &RedactionPolicy) -> Result<S::Ok, S::Error>
where
S: Serializer,
{
match self {
Some(value) => value.serialize_redacted_map(serializer, policy),
None => serializer.serialize_none(),
}
}
}
};
}
map_redact_serialize!(HashMap<K, V>);
map_redact_serialize!(BTreeMap<K, V>);