pub struct MaskMap { /* private fields */ }Expand description
A reversible mask map: the placeholder↔original mapping built while redacting an inbound
request, used to unmask the response (buffered and streamed) back to the caller’s own values.
The provider only ever sees placeholders; the client gets its data restored — the round-trip an
irreversible [REDACTED] tag (and any unmask that can restore another caller’s value) cannot do.
Identical source values collapse to one placeholder (so the model sees a consistent token and the unmask is unambiguous). The map is per-request and short-lived; it holds plaintext PII in memory only for the life of the request, exactly as the un-redacted body already does.
Implementations§
Source§impl MaskMap
impl MaskMap
Sourcepub fn is_empty(&self) -> bool
pub fn is_empty(&self) -> bool
True when nothing was masked (the response then needs no unmasking).
Sourcepub fn placeholder_for(&mut self, cat: &str, value: &str) -> String
pub fn placeholder_for(&mut self, cat: &str, value: &str) -> String
The placeholder for value (category cat), minting a new <edgeguard-<cat>-<n>> on first
sight and reusing it thereafter so equal values map to one token.
Sourcepub fn unmask(&self, text: &str) -> String
pub fn unmask(&self, text: &str) -> String
Unmask a complete buffer: replace every known placeholder with its original value in a single left-to-right pass (an original value is never re-scanned, so it can’t cascade).
Sourcepub fn unmask_stream(&self, carry: &mut Vec<u8>, data: &[u8]) -> Vec<u8> ⓘ
pub fn unmask_stream(&self, carry: &mut Vec<u8>, data: &[u8]) -> Vec<u8> ⓘ
Streaming unmask: append data to the held-back carry, unmask everything up to any trailing
incomplete placeholder, and return the bytes to emit now. The dangling tail (a placeholder that
may finish in the next frame) stays in carry. When the map is empty this is a pass-through, so
a non-reversible stream pays nothing.