Crate qubit_redact

Expand description

§Qubit Redact

Policy-driven, bounded redaction for fields, domain values, and diagnostic formats. RedactedTextComposer builds one ordered text result, while RedactionBatch builds independently resolvable results. Each object is single-use and publishes only through its consuming finish method.

use qubit_redact::Redactor;

let output = Redactor::strict()
    .text_composer()
    .literal("password=")
    .field("password", "raw-secret")
    .finish();
assert!(!output.text().as_str().contains("raw-secret"));

§Safety boundary

literal accepts only &'static str program literals. Dynamic text must be passed to a redaction operation. Derived fields that lack #[redact(...)] are intentionally unredacted. Field sensitivity belongs to the downstream domain: the framework cannot infer it reliably, and forcing explicit “not sensitive” annotations onto the ordinary majority of fields would add noise rather than knowledge. Downstream types must explicitly mark sensitive fields and review that classification when their model changes. Fields that explicitly use skip are neither accessed nor emitted.

With redaction enabled, Complete, Truncated, and Exhausted output text remains confidentiality-safe. Diagnostic formatters may publish that safe text without interpreting an incompleteness reason; callers inspect summaries only when completeness affects their own program contract.

A disabled application-default policy is an intentional process-wide debugging escape hatch. It restores raw values. The framework executes the selected policy, while downstream code owns authorization, timing, and any misuse. Generated Debug, Display, and Serialize implementations intentionally obtain Redactor::application_default at the start of each formatting or serialization call. Replacing the application default therefore affects future generated calls, including installation of a disabled policy. Existing explicit redactors, composers, and batches retain the policy snapshots they already own.

Transaction summaries are observations produced exclusively by a completed transaction; callers cannot fabricate one outside the runtime.

use qubit_redact::RedactionSummary;

let _ = RedactionSummary::complete();

The removed pre-0.5 transaction API cannot be imported as a public compatibility API.

use qubit_redact::RedactionSession;

use qubit_redact::RedactionSessionOutput;

use qubit_redact::RedactionOutput;

use qubit_redact::RedactionHandle;

use qubit_redact::RedactionHandleError;

use qubit_redact::Redactor;

let _ = Redactor::strict().session();

Composer and batch APIs deliberately do not overlap, and both publication methods consume their owner.

use qubit_redact::Redactor;

let composer = Redactor::strict().text_composer();
let _ = composer.finish();
let _ = composer.literal("cannot reuse a finished composer");

use qubit_redact::Redactor;

let mut batch = Redactor::strict().batch();
batch.literal("batch has no aggregate text API");

use qubit_redact::Redactor;

let mut batch = Redactor::strict().batch();
let _ = batch.redact_field("password", "raw-secret");
let _ = batch.finish_for_diagnostics("<redaction incomplete>");
let _ = batch.redact_field("password", "cannot reuse a finished batch");

use qubit_redact::Redactor;

let composer = Redactor::strict().text_composer();
let _ = composer.redact_field("password", "batch methods are unavailable");

use qubit_redact::Redactor;

let mut batch = Redactor::strict().batch();
let handle = batch.redact_field("password", "raw-secret");
let output = batch.finish_for_diagnostics("<redaction incomplete>");
let _ = output.text(handle);
let _ = handle.to_string();

The domain-level rendering traits do not provide an alternate output path. Domain values must be written through Redact and a RedactedTextComposer or RedactionBatch.

use qubit_redact::policy::RedactionPolicy;

Modules§

formats: Protocol and process-format adapters layered over the common runtime.

Structs§

AllowRule: A borrowed canonical field name and the breadth of its allow rule.
DebugDisplay: Presents a borrowed fmt::Debug value through fmt::Display.
FieldsBuilder: Mutable view over the base field policy.
HttpContextBuilderView: Mutable view over one HTTP field context.
HttpPolicyBuilderView: Mutable view over all HTTP context differences.
MaskingPolicy: Mask policies assigned to all supported sensitivity levels.
MaskingPolicyBuilder: Mutable construction state for a MaskingPolicy.
RedactedText: Final UTF-8 text produced by a redaction operation under its selected policy.
RedactedTextComposer: Builds one ordered, redacted text value through consuming chained calls.
RedactionBatch: Accumulates independently resolvable redaction items under one budget.
RedactionBatchDiagnostics: Presents batch items for diagnostics without exposing resolution errors.
RedactionBatchHandle: Opaque reference to one unpublished item in a crate::RedactionBatch.
RedactionFloor: Immutable minimum field-protection rules.
RedactionFloorBuilder: Builder for a RedactionFloor.
RedactionInspection: Highest sensitivity found by one complete, bounded inspection.
RedactionInspectionError: An inconclusive redaction inspection.
RedactionLimits: Structural and JSON limits for one redaction operation.
RedactionLimitsBuilder: Mutable construction state for RedactionLimits.
RedactionPolicy: Immutable field classification, masking, format, and resource policy.
RedactionPolicyBuilder: Mutable construction state for an immutable RedactionPolicy.
RedactionReasons: Compact set of summary reasons.
RedactionRules: Immutable, cheap-to-clone field classification snapshot.
RedactionSummary: Machine-readable summary of one redaction operation.
RedactionTextOutput: Published safe text and completion metadata from one redaction operation.
RedactionUsage: Measured resource use for one redaction transaction.
RedactionWriter: Restricted writer for one redaction operation.
Redactor: Applies one immutable policy snapshot to supported diagnostic values.
SensitiveFieldRule: A borrowed canonical field name and its configured sensitivity.
UriPolicyBuilderView: Mutable view over URI-specific behavior.

Enums§

FieldClassification: Explains why a field is sensitive, allowed, or unknown to a policy.
FieldMatchKind: Identifies the candidate that matched a configured field rule.
FieldNameMatching: Controls which canonical field-name candidates may match policy rules.
MaskPolicy: Strategy used to mask one sensitive field value.
PolicyError: Error returned when a redaction policy contains an invalid rule.
PolicyLocation: Policy construction context where a validation error occurred.
RedactionCompletion: Describes whether a redaction operation produced all required safe output.
RedactionReason: Reason why a safe representation is degraded.
SensitiveFieldPreset: Predefined groups of sensitive field names.
Sensitivity: Sensitivity assigned to a field or explicit value.
UnkeyedJsonValuePolicy: Controls whether unkeyed JSON scalar values are redacted or preserved.
UnknownFieldPolicy: Determines how a policy handles a field with no matching rule.

Traits§

Redact: Formats a domain object through the shared immutable redaction writer.

Derive Macros§

Redact: Derives the borrowing qubit_redact::Redact implementation.