Module redact 

Credential redaction for URL-ish strings shared across the binaries.

Two related invariants live here, both keyed on the rule that a URL can carry a secret no log or operator-facing error may echo:

• Userinfo — relay/origin URLs can carry user:pass@ userinfo. When such a string is named in a parse error or log (config-validate time, crate::config; node bring-up, the decdn-node runtime), the credentials are scrubbed by redact_userinfo, which preserves the host and path so the offending entry is still identifiable.
• Whole URL — a chain rpc_url secret commonly lives in the path or query (Infura/Alchemy keys), which userinfo redaction would NOT scrub. So when an rpc_url reaches a transport/chain error, strip_urls removes the URL entirely. The failure class (timeout, connection refused, DNS, TLS) usually lives in the error’s source() chain, not in its top-level Display. sanitize_err_chain (for an anyhow::Error) and sanitize_error_sources (for a typed std::error::Error) render that chain, so the class survives the strip. sanitize_rpc_display renders only the top-level Display, so it suits a plain Display value such as a String reason.

Routing every gate through this single module keeps each invariant from drifting between copies.

Functions

redact_userinfo

Replace any user:pass@ userinfo in a URL-ish string with ***@ so a parse-failure log/error can name the offending entry without leaking credentials.

sanitize_err_chain

Render an anyhow error’s full context: cause: cause chain with URL fragments stripped, through sanitize_error_sources: the context layers and the wrapped error’s source() chain share one walk, so a repeated layer is printed once and each layer is stripped on its own.

sanitize_error_sources

Render a typed error and each layer of its source() chain as outer: cause: cause, with URL fragments stripped.

sanitize_rpc_display

Render a plain Display value, with URL fragments stripped, for a single log/error line. Use for a value with no source() chain, such as a String reason.

strip_urls

Strip URL-bearing fragments from an error’s rendered text so an rpc_url secret never reaches a log or operator-facing error. Any failure class in the input text (timeout / connection refused / DNS / TLS) is kept; to include the source() chain, call sanitize_error_sources or sanitize_err_chain.