Crate rlg_redact 

PII / secret redaction for rlg records.

Wrap a rlg::log::Log with Redactor::scrub before firing it. Every string field (description + every string attribute value) is scanned once against a fused alternation of all loaded patterns; matches are replaced with the configured marker (default "[REDACTED]").

Built-in patterns cover the common PII / secret classes that show up in log streams. Add custom patterns with Redactor::with_pattern.

Performance model

Every mutator (Redactor::with_defaults, Redactor::with_pattern) compiles all currently-loaded patterns into a single Regex alternation. scrub performs one replace_all pass instead of N (once per pattern) — the DFA engine handles the union internally. Result: single-pass throughput, no repeated traversal of the input string.

The compilation cost is amortised at construction. Constructing Redactor::with_defaults is O(1) past the first call via a process-lifetime LazyLock. Ad-hoc with_pattern chains recompile the fused regex at each step; if you compose many patterns, build the full chain once and reuse the redactor.

Example

use rlg::log::Log;
use rlg_redact::Redactor;

let redactor = Redactor::with_defaults();
let log = Log::info("card 4111-1111-1111-1111 failed");
let scrubbed = redactor.scrub(log);
assert!(scrubbed.description.contains("[REDACTED]"));
assert!(!scrubbed.description.contains("4111"));

Structs

Redactor

A fused-alternation redactor: one regex, one pass, N patterns.

Constants

AWS_ACCESS_KEY

AWS access key IDs (AKIA…, ASIA…, etc.).

BEARER_TOKEN

OAuth Authorization: Bearer <token> headers.

CREDIT_CARD

Visa / MC / Amex / Discover. Matches 13-19 digits, optionally separated by spaces or hyphens. Luhn validation is not performed — false positives are preferred over false negatives for logs.

DEFAULT_MARKER

Default replacement marker.

EMAIL

RFC 5321 email addresses (good-enough subset).

IPV4

IPv4 dotted-quad addresses.

JWT

Three-segment base64url JWT (header.payload.signature).