qubit_redact/policy/field/
sensitive_field_preset.rs

1// =============================================================================
2//    Copyright (c) 2025 - 2026 Haixing Hu.
3//
4//    SPDX-License-Identifier: Apache-2.0
5//
6//    Licensed under the Apache License, Version 2.0.
7// =============================================================================
8//! Built-in groups of sensitive field names.
9
10use super::Sensitivity;
11
12/// Predefined groups of sensitive field names.
13///
14/// # Examples
15///
16/// ```
17/// use qubit_redact::SensitiveFieldPreset;
18///
19/// assert!(SensitiveFieldPreset::Credentials
20///     .fields()
21///     .iter()
22///     .any(|(field, _)| *field == "password"));
23/// ```
24#[non_exhaustive]
25#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
26pub enum SensitiveFieldPreset {
27    /// Passwords, client secrets, private keys, and secret-like names.
28    Credentials,
29    /// Connection strings and configuration values that embed credentials.
30    CredentialContainers,
31    /// API keys, access tokens, refresh tokens, and JWT-like names.
32    AuthTokens,
33    /// HTTP authentication and cookie fields.
34    Http,
35    /// Session identifiers and session tokens.
36    Session,
37}
38
39/// Field names for [`SensitiveFieldPreset::Credentials`].
40const CREDENTIALS_FIELDS: [(&str, Sensitivity); 17] = [
41    ("password", Sensitivity::Secret),
42    ("password_confirmation", Sensitivity::Secret),
43    ("passwd", Sensitivity::Secret),
44    ("passphrase", Sensitivity::Secret),
45    ("pgpassword", Sensitivity::Secret),
46    ("secret", Sensitivity::Secret),
47    ("client_secret", Sensitivity::Secret),
48    ("credential", Sensitivity::Secret),
49    ("credentials", Sensitivity::Secret),
50    ("private_key", Sensitivity::Secret),
51    ("privatekey", Sensitivity::Secret),
52    ("security_key", Sensitivity::Secret),
53    ("secret_key", Sensitivity::Secret),
54    ("secret_access_key", Sensitivity::Secret),
55    ("access_key", Sensitivity::High),
56    ("accesskey", Sensitivity::High),
57    ("access_key_id", Sensitivity::Medium),
58];
59
60/// Field names for [`SensitiveFieldPreset::CredentialContainers`].
61const CREDENTIAL_CONTAINER_FIELDS: [(&str, Sensitivity); 11] = [
62    ("dsn", Sensitivity::Secret),
63    ("database_dsn", Sensitivity::Secret),
64    ("redis_url", Sensitivity::Secret),
65    ("mongodb_uri", Sensitivity::Secret),
66    ("mongodb_url", Sensitivity::Secret),
67    ("amqp_url", Sensitivity::Secret),
68    ("broker_url", Sensitivity::Secret),
69    ("http_proxy", Sensitivity::Secret),
70    ("https_proxy", Sensitivity::Secret),
71    ("all_proxy", Sensitivity::Secret),
72    ("docker_auth_config", Sensitivity::Secret),
73];
74
75/// Field names for [`SensitiveFieldPreset::AuthTokens`].
76const AUTH_TOKEN_FIELDS: [(&str, Sensitivity); 11] = [
77    ("api_key", Sensitivity::High),
78    ("apikey", Sensitivity::High),
79    ("x_api_key", Sensitivity::High),
80    ("token", Sensitivity::High),
81    ("access_token", Sensitivity::High),
82    ("refresh_token", Sensitivity::High),
83    ("id_token", Sensitivity::High),
84    ("jwt", Sensitivity::High),
85    ("jwt_token", Sensitivity::High),
86    ("auth_token", Sensitivity::High),
87    ("bearer", Sensitivity::High),
88];
89
90/// Field names for [`SensitiveFieldPreset::Http`].
91const HTTP_FIELDS: [(&str, Sensitivity); 4] = [
92    ("authorization", Sensitivity::High),
93    ("proxy_authorization", Sensitivity::High),
94    ("cookie", Sensitivity::High),
95    ("set_cookie", Sensitivity::High),
96];
97
98/// Field names for [`SensitiveFieldPreset::Session`].
99const SESSION_FIELDS: [(&str, Sensitivity); 3] = [
100    ("session", Sensitivity::High),
101    ("session_id", Sensitivity::High),
102    ("session_token", Sensitivity::High),
103];
104
105impl SensitiveFieldPreset {
106    /// Returns the built-in field-name and sensitivity pairs in this preset.
107    ///
108    /// # Returns
109    ///
110    /// The complete built-in field table for this preset.
111    #[inline(always)]
112    #[must_use]
113    pub const fn fields(self) -> &'static [(&'static str, Sensitivity)] {
114        match self {
115            Self::Credentials => &CREDENTIALS_FIELDS,
116            Self::CredentialContainers => &CREDENTIAL_CONTAINER_FIELDS,
117            Self::AuthTokens => &AUTH_TOKEN_FIELDS,
118            Self::Http => &HTTP_FIELDS,
119            Self::Session => &SESSION_FIELDS,
120        }
121    }
122}
qubit_redact/policy/field/sensitive_field_preset.rs

qubit_redact/policy/field/
sensitive_field_preset.rs
