pub struct Redactor { /* private fields */ }Expand description
Applies one immutable policy snapshot to supported diagnostic values.
Composers and batches created from a redactor retain this snapshot even if
the process-wide application default changes later.
Self::replace_application_default is intentionally capable of installing
a disabled policy for process-wide debugging; only future snapshots observe
that replacement, and downstream code owns the confidentiality consequences.
§Design warning
The process-wide default and its ability to install
RedactionPolicy::disabled are intentional public design, not a missing
safety check. Code review must not report either capability as a defect or
remove it as a hardening change without an explicit compatibility decision.
§Examples
use qubit_redact::Redactor;
let output = Redactor::strict().redact_field("password", "raw-secret");
assert!(!output.text().as_str().contains("raw-secret"));Implementations§
Source§impl Redactor
impl Redactor
Sourcepub fn redact_view<'value, T: ?Sized>(
&self,
value: &'value T,
) -> RedactedView<'value, T>
pub fn redact_view<'value, T: ?Sized>( &self, value: &'value T, ) -> RedactedView<'value, T>
Creates a lazy borrowed view with an owned snapshot of this policy.
No source access or budget consumption occurs until the view is used.
Formatting requires Redact. With the serde feature, a derived
value’s view serializes structurally when its fields support the
required Serde adapters. Each use starts an independent execution.
§Type Parameters
'value: Lifetime of the borrowed source value.T: Source type; capabilities are checked when the view is used.
§Parameters
value: Source retained by reference without evaluating it.
§Returns
A reusable borrowed view that owns this redactor’s policy snapshot.
Sourcepub fn redact_text<T>(&self, value: &T) -> RedactionTextOutput
pub fn redact_text<T>(&self, value: &T) -> RedactionTextOutput
Redacts one domain value into final text and an execution summary.
§Type Parameters
T: Domain type exposing structured redaction.
§Parameters
value: Borrowed domain value visited within one fresh budget.
§Returns
Final redacted text and its execution summary, including any truncation or admission failure recorded while processing the value.
Sourcepub fn inspect<T>(
&self,
value: &T,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect<T>( &self, value: &T, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects one domain value without rendering any field content.
§Errors
Returns an inconclusive result when structural or input admission prevents the complete domain value from being classified.
§Type Parameters
T: Domain type exposing structured redaction.
§Parameters
value: Borrowed domain value to classify without rendering fields.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Sourcepub fn redact_field<T>(&self, field: &str, value: &T) -> RedactionTextOutput
pub fn redact_field<T>(&self, field: &str, value: &T) -> RedactionTextOutput
Redacts one scalar field through a complete one-item transaction.
§Type Parameters
T: Scalar formatter evaluated only when admission and masking require it.
§Parameters
field: Raw field key used for admission and classification.value: Scalar whose formatting is deferred until required.
§Returns
Final redacted text and its execution summary, including any truncation or admission failure recorded while processing the value.
Sourcepub fn inspect_field(
&self,
field: &str,
value: &str,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect_field( &self, field: &str, value: &str, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects one scalar field without rendering its value.
§Errors
Returns RedactionInspectionError when an input, structural, or key
limit prevents a conclusive classification.
§Parameters
field: Raw key used for admission and classification.value: Source text counted for inspection without rendering it.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Source§impl Redactor
impl Redactor
Sourcepub fn redact_http_url(&self, value: &str) -> RedactionTextOutput
pub fn redact_http_url(&self, value: &str) -> RedactionTextOutput
Sourcepub fn inspect_http_url(
&self,
value: &str,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect_http_url( &self, value: &str, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects one HTTP URL without rendering it.
§Errors
Returns RedactionInspectionError when the URL is invalid or a
shared resource limit prevents complete inspection.
§Parameters
value: Raw HTTP URL, including its authority, path, query, and fragment.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Sourcepub fn redact_http_headers(&self, headers: &HeaderMap) -> RedactionTextOutput
pub fn redact_http_headers(&self, headers: &HeaderMap) -> RedactionTextOutput
Sourcepub fn inspect_http_headers(
&self,
headers: &HeaderMap,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect_http_headers( &self, headers: &HeaderMap, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects HTTP headers without rendering their values.
§Errors
Returns RedactionInspectionError when a header cannot be decoded
safely or a shared resource limit prevents complete inspection.
§Parameters
headers: Borrowed header collection, including repeated values.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Sourcepub fn redact_http_body(
&self,
capture: BodyCapture<'_>,
content_type: Option<&HeaderValue>,
) -> RedactionTextOutput
pub fn redact_http_body( &self, capture: BodyCapture<'_>, content_type: Option<&HeaderValue>, ) -> RedactionTextOutput
Redacts one captured HTTP body through one completed session transaction.
§Parameters
capture: Captured bytes and completeness metadata used before body parsing.content_type: Optional media-type metadata; None selects the missing-type handling policy.
§Returns
Final redacted text and its execution summary, including any truncation or admission failure recorded while processing the value.
Sourcepub fn inspect_http_body(
&self,
capture: BodyCapture<'_>,
content_type: Option<&HeaderValue>,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect_http_body( &self, capture: BodyCapture<'_>, content_type: Option<&HeaderValue>, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects one captured HTTP body without rendering it.
§Errors
Returns RedactionInspectionError when capture metadata, content
type, body syntax, or a shared resource limit makes inspection
inconclusive.
§Parameters
capture: Captured bytes and completeness metadata used before body parsing.content_type: Optional media-type metadata; None selects the missing-type handling policy.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Sourcepub fn redact_http_body_with_content_type_text(
&self,
capture: BodyCapture<'_>,
content_type: Option<&str>,
) -> RedactionTextOutput
pub fn redact_http_body_with_content_type_text( &self, capture: BodyCapture<'_>, content_type: Option<&str>, ) -> RedactionTextOutput
Redacts one captured HTTP body using textual Content-Type metadata.
§Parameters
capture: Captured bytes and completeness metadata used before body parsing.content_type: Optional media-type metadata; None selects the missing-type handling policy.
§Returns
Final redacted text and its execution summary, including any truncation or admission failure recorded while processing the value.
Sourcepub fn inspect_http_body_with_content_type_text(
&self,
capture: BodyCapture<'_>,
content_type: Option<&str>,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect_http_body_with_content_type_text( &self, capture: BodyCapture<'_>, content_type: Option<&str>, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects one captured HTTP body using textual Content-Type metadata.
§Errors
Returns RedactionInspectionError when capture metadata, content
type, body syntax, or a shared resource limit makes inspection
inconclusive.
§Parameters
capture: Captured bytes and completeness metadata used before body parsing.content_type: Optional media-type metadata; None selects the missing-type handling policy.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Source§impl Redactor
impl Redactor
Sourcepub fn to_json<'value, T: RedactSerializeSource + ?Sized>(
&self,
value: &'value T,
) -> Result<String, JsonError>where
T::RedactedFields<'value>: Serialize,
pub fn to_json<'value, T: RedactSerializeSource + ?Sized>(
&self,
value: &'value T,
) -> Result<String, JsonError>where
T::RedactedFields<'value>: Serialize,
Serializes a domain object’s redacted view as compact JSON.
This uses domain field declarations, unlike redact_json, which parses
input JSON and classifies its keys. It shares the view’s projection and
logical Serde payload budget, and additionally bounds the final encoded
JSON by max_output_bytes, including labels, framing, and escaping.
Serialization runs once; no partial string is returned on failure.
With identical source state, outputs match direct view serialization
when both succeed. The view’s fields must support redacted
serialization.
§Errors
Propagates JSON serializer errors and errors from the structured redaction budget. Successful serialization can contain the structured runtime’s opaque replacements; it is not a completeness assertion.
§Type Parameters
'value: Source borrow retained while serializing the projection.T: Possibly unsized source whose borrowed redacted fields implement Serialize.
§Parameters
value: Source borrowed and traversed once through its redacted projection.
§Returns
A complete compact JSON string within the final encoded output limit.
Sourcepub fn redact_json(&self, text: &str) -> RedactionTextOutput
pub fn redact_json(&self, text: &str) -> RedactionTextOutput
Sourcepub fn redact_json_value(&self, value: &Value) -> RedactionTextOutput
pub fn redact_json_value(&self, value: &Value) -> RedactionTextOutput
Sourcepub fn inspect_json(
&self,
text: &str,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect_json( &self, text: &str, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects one JSON document without rendering it.
§Errors
Returns RedactionInspectionError when JSON parsing fails or a
shared resource limit prevents complete inspection.
§Parameters
text: Complete raw JSON input to classify without rendering values.
§Returns
A conclusive sensitivity observation when parsing and traversal complete.
Sourcepub fn inspect_json_value(
&self,
value: &Value,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect_json_value( &self, value: &Value, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects a borrowed parsed JSON value without taking ownership of it.
§Errors
Returns RedactionInspectionError when a shared structural, value,
or input limit prevents complete inspection.
§Parameters
value: Borrowed parsed tree to classify without rendering values.
§Returns
A conclusive sensitivity observation when the entire traversal is admitted.
Source§impl Redactor
impl Redactor
Sourcepub fn redact_argv<'items, I>(&self, items: I) -> RedactionTextOutputwhere
I: IntoIterator<Item = ArgvItem<'items>>,
pub fn redact_argv<'items, I>(&self, items: I) -> RedactionTextOutputwhere
I: IntoIterator<Item = ArgvItem<'items>>,
Redacts an argument vector through one completed text transaction.
§Type Parameters
'items: Borrow of argument item contents.I: One-pass iterator preserving argument order.
§Parameters
items: Arguments with caller-supplied classification hints.
§Returns
Final redacted text and its execution summary, including any truncation or admission failure recorded while processing the value.
Sourcepub fn inspect_argv<'items, I>(
&self,
items: I,
) -> Result<RedactionInspection, RedactionInspectionError>where
I: IntoIterator<Item = ArgvItem<'items>>,
pub fn inspect_argv<'items, I>(
&self,
items: I,
) -> Result<RedactionInspection, RedactionInspectionError>where
I: IntoIterator<Item = ArgvItem<'items>>,
Inspects explicitly classified argv items without rendering them.
§Errors
Returns RedactionInspectionError when non-UTF-8 data or a shared
resource limit prevents complete inspection.
§Type Parameters
'items: Borrow of argument item contents.I: One-pass iterator preserving argument order.
§Parameters
items: Arguments with caller-supplied classification hints.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Sourcepub fn redact_heuristic_argv<'items, I>(&self, items: I) -> RedactionTextOutputwhere
I: IntoIterator<Item = ArgvItem<'items>>,
pub fn redact_heuristic_argv<'items, I>(&self, items: I) -> RedactionTextOutputwhere
I: IntoIterator<Item = ArgvItem<'items>>,
Redacts argv items using heuristic option classification.
§Type Parameters
'items: Borrow of argument item contents.I: One-pass iterator preserving argument order.
§Parameters
items: Arguments with caller-supplied classification hints.
§Returns
Final redacted text and its execution summary, including any truncation or admission failure recorded while processing the value.
Sourcepub fn inspect_heuristic_argv<'items, I>(
&self,
items: I,
) -> Result<RedactionInspection, RedactionInspectionError>where
I: IntoIterator<Item = ArgvItem<'items>>,
pub fn inspect_heuristic_argv<'items, I>(
&self,
items: I,
) -> Result<RedactionInspection, RedactionInspectionError>where
I: IntoIterator<Item = ArgvItem<'items>>,
Inspects argv items using heuristic option classification.
§Errors
Returns RedactionInspectionError when non-UTF-8 data, incomplete
option syntax, or a shared resource limit prevents complete inspection.
§Type Parameters
'items: Borrow of argument item contents.I: One-pass iterator preserving argument order.
§Parameters
items: Arguments with caller-supplied classification hints.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Sourcepub fn redact_env(&self, name: &str, value: &str) -> RedactionTextOutput
pub fn redact_env(&self, name: &str, value: &str) -> RedactionTextOutput
Redacts one environment assignment through one completed transaction.
§Parameters
name: Environment variable name used for classification.value: Environment variable value to inspect or redact.
§Returns
Final redacted text and its execution summary, including any truncation or admission failure recorded while processing the value.
Sourcepub fn inspect_env(
&self,
name: &str,
value: &str,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect_env( &self, name: &str, value: &str, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects one environment assignment without rendering it.
§Errors
Returns RedactionInspectionError when the shared input or
structural budget prevents complete inspection.
§Parameters
name: Environment variable name used for classification.value: Environment variable value to inspect or redact.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Sourcepub fn redact_env_pairs<'items, I>(&self, pairs: I) -> RedactionTextOutput
pub fn redact_env_pairs<'items, I>(&self, pairs: I) -> RedactionTextOutput
Redacts environment assignments through one completed transaction.
§Type Parameters
'items: Borrow of native environment names and values.I: One-pass iterator of environment assignments.
§Parameters
pairs: Native names and values, visited in iterator order.
§Returns
Final redacted text and its execution summary, including any truncation or admission failure recorded while processing the value.
Sourcepub fn inspect_env_pairs<'items, I>(
&self,
pairs: I,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect_env_pairs<'items, I>( &self, pairs: I, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects environment assignments without rendering them.
§Errors
Returns RedactionInspectionError when non-UTF-8 data or a shared
resource limit prevents complete inspection.
§Type Parameters
'items: Borrow of native environment names and values.I: One-pass iterator of environment assignments.
§Parameters
pairs: Native names and values, visited in iterator order.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Sourcepub fn redact_process<'arguments, 'variables, A, E>(
&self,
program: &'arguments OsStr,
arguments: A,
variables: E,
) -> RedactionTextOutputwhere
A: IntoIterator<Item = ArgvItem<'arguments>>,
E: IntoIterator<Item = (&'variables OsStr, &'variables OsStr)>,
pub fn redact_process<'arguments, 'variables, A, E>(
&self,
program: &'arguments OsStr,
arguments: A,
variables: E,
) -> RedactionTextOutputwhere
A: IntoIterator<Item = ArgvItem<'arguments>>,
E: IntoIterator<Item = (&'variables OsStr, &'variables OsStr)>,
Redacts one process command through one completed text transaction.
§Type Parameters
'arguments: Borrow of the executable and argument data.'variables: Borrow of environment names and values.A: One-pass iterator of argument items.E: One-pass iterator of environment assignments.
§Parameters
program: Executable represented as native operating-system text.arguments: Arguments in their original command order.variables: Environment assignments appended after command processing.
§Returns
Final redacted text and its execution summary, including any truncation or admission failure recorded while processing the value.
Sourcepub fn inspect_process<'arguments, 'variables, A, E>(
&self,
program: &'arguments OsStr,
arguments: A,
variables: E,
) -> Result<RedactionInspection, RedactionInspectionError>where
A: IntoIterator<Item = ArgvItem<'arguments>>,
E: IntoIterator<Item = (&'variables OsStr, &'variables OsStr)>,
pub fn inspect_process<'arguments, 'variables, A, E>(
&self,
program: &'arguments OsStr,
arguments: A,
variables: E,
) -> Result<RedactionInspection, RedactionInspectionError>where
A: IntoIterator<Item = ArgvItem<'arguments>>,
E: IntoIterator<Item = (&'variables OsStr, &'variables OsStr)>,
Inspects one process command without rendering its components.
§Errors
Returns RedactionInspectionError when argv or environment data is
invalid, incomplete, or rejected by a shared resource limit.
§Type Parameters
'arguments: Borrow of the executable and argument data.'variables: Borrow of environment names and values.A: One-pass iterator of argument items.E: One-pass iterator of environment assignments.
§Parameters
program: Executable represented as native operating-system text.arguments: Arguments in their original command order.variables: Environment assignments appended after command processing.
§Returns
A conclusive sensitivity inspection, or a value-free error containing resource usage and reasons why complete classification was unavailable.
Source§impl Redactor
impl Redactor
Sourcepub fn redact_uri(&self, input: &str) -> RedactionTextOutput
pub fn redact_uri(&self, input: &str) -> RedactionTextOutput
Sourcepub fn inspect_uri(
&self,
input: &str,
) -> Result<RedactionInspection, RedactionInspectionError>
pub fn inspect_uri( &self, input: &str, ) -> Result<RedactionInspection, RedactionInspectionError>
Inspects one URI without rendering it.
§Errors
Returns RedactionInspectionError when URI parsing fails or a
shared resource limit prevents complete inspection.
§Parameters
input: Raw URI to classify without rendering its components.
§Returns
A conclusive sensitivity inspection, or a value-free error retaining usage and reasons.
Source§impl Redactor
impl Redactor
Sourcepub fn new(policy: RedactionPolicy) -> Self
pub fn new(policy: RedactionPolicy) -> Self
Sourcepub fn standard() -> Self
pub fn standard() -> Self
Creates a redactor from the immutable built-in standard policy.
§Returns
A new redactor whose policy is independent of the application default.
Sourcepub fn strict() -> Self
pub fn strict() -> Self
Creates a redactor with the strict policy for untrusted scalar data.
Unknown fields are masked at crate::Sensitivity::Secret.
§Returns
A new redactor that treats unrecognized scalar fields as secret.
Sourcepub fn application_default() -> Self
pub fn application_default() -> Self
Returns a snapshot of the current application default redactor.
The returned value is detached from the global slot. Later calls to
Self::replace_application_default do not alter this redactor or
composers and batches created from it.
§Design warning
This API intentionally exposes the application default as a snapshot. Do not treat its process-wide source as a defect or replace it with an implicit per-call policy during review; downstream code relies on these snapshot semantics.
§Returns
An owned clone of the current process-wide policy snapshot.
Sourcepub fn text_composer(&self) -> RedactedTextComposer
pub fn text_composer(&self) -> RedactedTextComposer
Starts one ordered text-composition transaction.
The returned composer owns a fresh budget ledger initialized from this
redactor’s immutable policy snapshot. Its consuming finish method
publishes one crate::RedactionTextOutput.
§Returns
A composer for one independently bounded ordered text result.
Sourcepub fn diagnostic_batch(&self) -> DiagnosticRedactionBatch
pub fn diagnostic_batch(&self) -> DiagnosticRedactionBatch
Starts one batch of independently resolvable redaction items.
The returned batch owns a fresh budget ledger initialized from this redactor’s immutable policy snapshot. Its consuming diagnostics finish method publishes fail-closed item views.
§Returns
A mutable batch that issues handles resolvable only from its finished output.
Sourcepub fn policy(&self) -> &RedactionPolicy
pub fn policy(&self) -> &RedactionPolicy
Returns the immutable policy used by this redactor.
§Returns
A borrowed view of the redactor’s policy snapshot.
Sourcepub fn replace_application_default(redactor: Self) -> Self
pub fn replace_application_default(redactor: Self) -> Self
Atomically replaces the application default redactor.
The replacement is linearizable: concurrent readers observe either the
complete previous snapshot or the complete new snapshot. Existing
redactors, composers, and batches keep their own snapshots. The previous
default is returned so callers can restore it after a scoped change.
Installing RedactionPolicy::disabled is an intentional global
debugging escape hatch. The framework does not authorize or reject that
choice; the caller owns its environment and confidentiality boundary.
§Design warning
Accepting a redactor whose policy is RedactionPolicy::disabled is
deliberate. Do not report this capability as a defect or remove it as a
hardening change during review. It is required for explicitly authorized
diagnostic debugging, and changes require a compatibility decision.
§Parameters
redactor: Complete snapshot to install for future default readers.
§Returns
The previous application default, which callers may retain or restore.