qubit_redact/policy/field/
sensitive_field_preset.rs

1// =============================================================================
2//    Copyright (c) 2025 - 2026 Haixing Hu.
3//
4//    SPDX-License-Identifier: Apache-2.0
5//
6//    Licensed under the Apache License, Version 2.0.
7// =============================================================================
8//! Built-in groups of sensitive field names.
9
10use super::Sensitivity;
11
12/// Predefined groups of sensitive field names.
13#[non_exhaustive]
14#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
15pub enum SensitiveFieldPreset {
16    /// Passwords, client secrets, private keys, and secret-like names.
17    Credentials,
18    /// Connection strings and configuration values that embed credentials.
19    CredentialContainers,
20    /// API keys, access tokens, refresh tokens, and JWT-like names.
21    AuthTokens,
22    /// HTTP authentication and cookie fields.
23    Http,
24    /// Session identifiers and session tokens.
25    Session,
26}
27
28/// Field names for [`SensitiveFieldPreset::Credentials`].
29const CREDENTIALS_FIELDS: [(&str, Sensitivity); 17] = [
30    ("password", Sensitivity::Secret),
31    ("password_confirmation", Sensitivity::Secret),
32    ("passwd", Sensitivity::Secret),
33    ("passphrase", Sensitivity::Secret),
34    ("pgpassword", Sensitivity::Secret),
35    ("secret", Sensitivity::Secret),
36    ("client_secret", Sensitivity::Secret),
37    ("credential", Sensitivity::Secret),
38    ("credentials", Sensitivity::Secret),
39    ("private_key", Sensitivity::Secret),
40    ("privatekey", Sensitivity::Secret),
41    ("security_key", Sensitivity::Secret),
42    ("secret_key", Sensitivity::Secret),
43    ("secret_access_key", Sensitivity::Secret),
44    ("access_key", Sensitivity::High),
45    ("accesskey", Sensitivity::High),
46    ("access_key_id", Sensitivity::Medium),
47];
48
49/// Field names for [`SensitiveFieldPreset::CredentialContainers`].
50const CREDENTIAL_CONTAINER_FIELDS: [(&str, Sensitivity); 11] = [
51    ("dsn", Sensitivity::Secret),
52    ("database_dsn", Sensitivity::Secret),
53    ("redis_url", Sensitivity::Secret),
54    ("mongodb_uri", Sensitivity::Secret),
55    ("mongodb_url", Sensitivity::Secret),
56    ("amqp_url", Sensitivity::Secret),
57    ("broker_url", Sensitivity::Secret),
58    ("http_proxy", Sensitivity::Secret),
59    ("https_proxy", Sensitivity::Secret),
60    ("all_proxy", Sensitivity::Secret),
61    ("docker_auth_config", Sensitivity::Secret),
62];
63
64/// Field names for [`SensitiveFieldPreset::AuthTokens`].
65const AUTH_TOKEN_FIELDS: [(&str, Sensitivity); 11] = [
66    ("api_key", Sensitivity::High),
67    ("apikey", Sensitivity::High),
68    ("x_api_key", Sensitivity::High),
69    ("token", Sensitivity::High),
70    ("access_token", Sensitivity::High),
71    ("refresh_token", Sensitivity::High),
72    ("id_token", Sensitivity::High),
73    ("jwt", Sensitivity::High),
74    ("jwt_token", Sensitivity::High),
75    ("auth_token", Sensitivity::High),
76    ("bearer", Sensitivity::High),
77];
78
79/// Field names for [`SensitiveFieldPreset::Http`].
80const HTTP_FIELDS: [(&str, Sensitivity); 4] = [
81    ("authorization", Sensitivity::High),
82    ("proxy_authorization", Sensitivity::High),
83    ("cookie", Sensitivity::High),
84    ("set_cookie", Sensitivity::High),
85];
86
87/// Field names for [`SensitiveFieldPreset::Session`].
88const SESSION_FIELDS: [(&str, Sensitivity); 3] = [
89    ("session", Sensitivity::High),
90    ("session_id", Sensitivity::High),
91    ("session_token", Sensitivity::High),
92];
93
94impl SensitiveFieldPreset {
95    /// Returns the built-in field-name and sensitivity pairs in this preset.
96    ///
97    /// # Returns
98    ///
99    /// The complete built-in field table for this preset.
100    #[inline(always)]
101    #[must_use]
102    pub const fn fields(self) -> &'static [(&'static str, Sensitivity)] {
103        match self {
104            Self::Credentials => &CREDENTIALS_FIELDS,
105            Self::CredentialContainers => &CREDENTIAL_CONTAINER_FIELDS,
106            Self::AuthTokens => &AUTH_TOKEN_FIELDS,
107            Self::Http => &HTTP_FIELDS,
108            Self::Session => &SESSION_FIELDS,
109        }
110    }
111}
qubit_redact/policy/field/sensitive_field_preset.rs

qubit_redact/policy/field/
sensitive_field_preset.rs
