vecboost 0.2.0

High-performance embedding vector service written in Rust
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

// Copyright (c) 2025-2026 Kirky.X
//
// Licensed under MIT License
// See LICENSE file in the project root for full license information

//! Security utilities for sanitizing sensitive data in logs and outputs.

/// Sanitize a string by masking sensitive content.
/// Replaces the middle portion of the string with asterisks, showing only first and last 2 characters.
///
/// Uses `floor_char_boundary`/`ceil_char_boundary` to guarantee UTF-8 safe slicing
/// even when the 2-byte boundary falls inside a multi-byte character (e.g. CJK).
///
/// # Examples
/// ```
/// use vecboost::security::sanitize_secret;
///
/// let secret = "my_super_secret_key_12345";
/// let sanitized = sanitize_secret(&secret);
/// assert_eq!(sanitized, "my*********************45");
/// ```
pub fn sanitize_secret(s: &str) -> String {
    if s.len() <= 4 {
        "*".repeat(s.len())
    } else {
        let first_end = s.floor_char_boundary(2);
        let (first, rest) = s.split_at(first_end);
        let last_start = rest.ceil_char_boundary(rest.len().saturating_sub(2));
        let (middle, last) = rest.split_at(last_start);
        format!("{}{}{}", first, "*".repeat(middle.len()), last)
    }
}

/// Sanitize a password field - shows only length, not content.
pub fn sanitize_password(s: &str) -> String {
    format!("[{} chars]", s.len())
}

/// Sanitize a JWT secret - shows only prefix and length.
///
/// Uses `floor_char_boundary` to guarantee UTF-8 safe prefix slicing.
pub fn sanitize_jwt_secret(s: &str) -> String {
    format!("{}... [{} chars]", &s[..s.floor_char_boundary(8)], s.len())
}

/// Sanitize an API key - shows only first 8 characters.
pub fn sanitize_api_key(s: &str) -> String {
    sanitize_secret(s)
}

/// Check if a field name likely contains sensitive data.
pub fn is_sensitive_field(field_name: &str) -> bool {
    const SENSITIVE_PATTERNS: &[&str] = &[
        "password",
        "secret",
        "token",
        "key",
        "credential",
        "auth",
        "private",
        "encryption",
        "api_key",
        "jwt",
        "admin_pass",
    ];

    let lower = field_name.to_lowercase();
    SENSITIVE_PATTERNS.iter().any(|p| lower.contains(*p))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_sanitize_secret_short() {
        assert_eq!(sanitize_secret("abc"), "***");
        assert_eq!(sanitize_secret("ab"), "**");
        assert_eq!(sanitize_secret("a"), "*");
        assert_eq!(sanitize_secret(""), "");
    }

    #[test]
    fn test_sanitize_secret_long() {
        let secret = "my_super_secret_key_12345";
        let sanitized = sanitize_secret(secret);
        // Shows first 2 chars, last 2 chars, masks middle
        assert_eq!(sanitized, "my*********************45");
        assert!(sanitized.starts_with("my"));
        assert!(sanitized.ends_with("45"));
        assert!(sanitized.contains('*'));
    }

    #[test]
    fn test_sanitize_password() {
        assert_eq!(sanitize_password("password123"), "[11 chars]");
    }

    #[test]
    fn test_sanitize_jwt_secret() {
        let jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9";
        let sanitized = sanitize_jwt_secret(jwt);
        assert!(sanitized.starts_with("eyJhbGci..."));
        assert!(sanitized.contains("[36 chars]"));
    }

    #[test]
    fn test_sanitize_secret_multibyte_no_panic() {
        // CJK: each char is 3 bytes; the 2-byte boundary falls inside the
        // first char, which would panic without floor_char_boundary.
        let secret = "密钥内容不能泄露abcdefgh";
        let sanitized = sanitize_secret(secret);
        assert!(sanitized.contains('*'));
    }

    #[test]
    fn test_sanitize_jwt_secret_multibyte_no_panic() {
        // 8-byte boundary falls inside the 3rd CJK char (each 3 bytes)
        let jwt = "密钥secretjwt1234567890";
        let sanitized = sanitize_jwt_secret(jwt);
        assert!(sanitized.contains(&format!("[{} chars]", jwt.len())));
    }

    #[test]
    fn test_is_sensitive_field() {
        assert!(is_sensitive_field("jwt_secret"));
        assert!(is_sensitive_field("default_admin_password"));
        assert!(is_sensitive_field("api_key"));
        assert!(is_sensitive_field("encryption_key"));
        assert!(is_sensitive_field("AUTH_TOKEN"));
        assert!(!is_sensitive_field("host"));
        assert!(!is_sensitive_field("port"));
        assert!(!is_sensitive_field("username"));
    }
}