redact

README

CensGate Redact

A powerful, extensible redaction library for Go that provides comprehensive PII/PHI detection and redaction capabilities with policy-aware and multi-tenant support.

Features

🔧 Extensible Architecture

• Pluggable Providers: Support for different redaction strategies
• Factory Pattern: Easy provider instantiation and configuration
• Interface-driven: Clean separation of concerns with well-defined interfaces

🛡️ Comprehensive Redaction

• Multiple Modes: Replace, mask, remove, tokenize, hash, encrypt, and LLM-ready
• Pattern Detection: Advanced regex-based detection for various PII/PHI types
• Custom Patterns: Support for user-defined redaction patterns
• Reversible Redaction: Token-based restoration for authorized access

📋 Policy Integration

• Rule Validation: Comprehensive validation of policy rules and patterns
• Conditional Redaction: Context-based rule application
• Priority Processing: Ordered rule evaluation for consistent results

🏢 Multi-tenant Support

• Tenant Isolation: Per-tenant redaction policies and configurations
• Policy Inheritance: Base policies with tenant-specific overrides
• Pluggable Storage: Abstract storage interface for policy persistence

🚀 Performance & Reliability

• Thread-safe: Concurrent-safe implementations
• Caching: Intelligent caching for performance optimization
• Resource Management: Proper cleanup and resource handling

Quick Start

Installation

go get github.com/censgate/redact@v0.1.0

Basic Usage

package main

import (
    "fmt"
    "log"
    
    "github.com/censgate/redact/pkg/redaction"
)

func main() {
    // Create a basic redaction engine
    engine := redaction.NewRedactionEngine()
    
    // Redact text
    text := "My email is john.doe@example.com and my SSN is 123-45-6789"
    result := engine.RedactText(text)
    
    fmt.Printf("Original: %s\n", result.OriginalText)
    fmt.Printf("Redacted: %s\n", result.RedactedText)
    fmt.Printf("Redactions: %d\n", len(result.Redactions))
    
    // Restore original text (if token-based redaction was used)
    if result.Token != "" {
        original, err := engine.RestoreText(result.Token)
        if err == nil {
            fmt.Printf("Restored: %s\n", original)
        }
    }
}

Using the Factory Pattern

package main

import (
    "context"
    "fmt"
    "time"
    
    "github.com/censgate/redact/pkg/redaction"
)

func main() {
    // Create factory
    factory := redaction.NewRedactionProviderFactory()
    
    // Create policy-aware provider
    provider, err := factory.CreatePolicyAwareProvider(&redaction.ProviderConfig{
        Type:          redaction.ProviderTypePolicyAware,
        MaxTextLength: 1024 * 1024, // 1MB
        DefaultTTL:    24 * time.Hour,
    })
    if err != nil {
        log.Fatal(err)
    }
    
    // Create redaction request
    request := &redaction.RedactionRequest{
        Text:       "Contact us at support@company.com",
        Mode:       redaction.ModeReplace,
        Reversible: true,
    }
    
    // Perform redaction
    result, err := provider.RedactText(context.Background(), request)
    if err != nil {
        log.Fatal(err)
    }
    
    fmt.Printf("Redacted: %s\n", result.RedactedText)
}

Multi-tenant Usage

package main

import (
    "context"
    "log"
    
    "github.com/censgate/redact/pkg/redaction"
)

func main() {
    // Create tenant-aware provider
    factory := redaction.NewRedactionProviderFactory()
    provider, err := factory.CreateTenantAwareProvider(&redaction.ProviderConfig{
        Type:        redaction.ProviderTypeTenantAware,
        PolicyStore: redaction.NewInMemoryPolicyStore(),
    })
    if err != nil {
        log.Fatal(err)
    }
    
    // Set tenant policy
    tenantPolicy := &redaction.TenantPolicy{
        TenantID:    "tenant-123",
        Name:        "Healthcare Policy",
        DefaultMode: redaction.ModeHash,
        Rules: []redaction.PolicyRule{
            {
                Name:     "PHI_EMAIL",
                Patterns: []string{`\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b`},
                Fields:   []string{"content"},
                Mode:     redaction.ModeEncrypt,
                Enabled:  true,
            },
        },
        ComplianceReqs: []string{"HIPAA"},
    }
    
    err = provider.SetTenantPolicy(context.Background(), "tenant-123", tenantPolicy)
    if err != nil {
        log.Fatal(err)
    }
    
    // Perform tenant-specific redaction
    request := &redaction.RedactionRequest{
        Text: "Patient email: patient@hospital.com",
    }
    
    result, err := provider.RedactForTenant(context.Background(), "tenant-123", request)
    if err != nil {
        log.Fatal(err)
    }
    
    fmt.Printf("Tenant-redacted: %s\n", result.RedactedText)
}

Supported Redaction Types

• Email addresses: john@example.com
• Phone numbers: (555) 123-4567, 555-123-4567
• Social Security Numbers: 123-45-6789
• Credit card numbers: 4111-1111-1111-1111
• IP addresses: 192.168.1.1
• URLs: https://example.com
• Dates: 12/25/2023, 2023-12-25
• MAC addresses: 00:1B:44:11:3A:B7
• Bitcoin addresses: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
• Hash values: MD5, SHA1, SHA256
• GUIDs/UUIDs: 550e8400-e29b-41d4-a716-446655440000
• Custom patterns: User-defined regex patterns

Redaction Modes

Mode	Description	Reversible	Example
replace	Replace with placeholder	No	[EMAIL_REDACTED]
mask	Replace with mask characters	No	****@******.***
remove	Remove entirely	No	``
tokenize	Replace with reversible token	Yes	[TOKEN_ABC123]
hash	Replace with hash	No	[HASH_SHA256]
encrypt	Replace with encrypted value	Yes	[ENCRYPTED_DATA]
llm	AI-powered context-aware	Configurable	[AI_REDACTED]

Provider Types

Basic Provider

• Standard pattern-based redaction
• No policy support
• Single-tenant

Policy-Aware Provider

• Policy-driven redaction rules
• Rule validation and conditional logic
• Priority-based processing

Tenant-Aware Provider

• Multi-tenant policy support
• Per-tenant configurations
• Policy inheritance

LLM Provider (Coming Soon)

• AI-powered redaction
• Context-aware processing
• Configurable AI models

Configuration

Provider Configuration

config := &redaction.ProviderConfig{
    Type:          redaction.ProviderTypeTenantAware,
    MaxTextLength: 2048 * 1024, // 2MB
    DefaultTTL:    48 * time.Hour,
    PolicyStore:   customPolicyStore,
    LLMConfig: &redaction.LLMConfig{
        Provider:    "openai",
        Model:       "gpt-4",
        Temperature: 0.1,
        MaxTokens:   1000,
    },
}

Policy Rules

rule := redaction.PolicyRule{
    Name:     "SENSITIVE_DATA",
    Patterns: []string{
        `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b`, // Email
        `\b\d{3}-\d{2}-\d{4}\b`,                                 // SSN
    },
    Fields:   []string{"content", "description"},
    Mode:     redaction.ModeEncrypt,
    Priority: 100,
    Enabled:  true,
    Conditions: []redaction.PolicyCondition{
        {
            Field:    "user_role",
            Operator: "ne",
            Value:    "admin",
        },
    },
}

Advanced Features

Custom Policy Store

type CustomPolicyStore struct {
    db *sql.DB
}

func (s *CustomPolicyStore) GetTenantPolicy(ctx context.Context, tenantID string) (*redaction.TenantPolicy, error) {
    // Implementation for database storage
    return policy, nil
}

func (s *CustomPolicyStore) SetTenantPolicy(ctx context.Context, tenantID string, policy *redaction.TenantPolicy) error {
    // Implementation for database storage
    return nil
}

Statistics and Monitoring

stats := provider.GetStats()
fmt.Printf("Total redactions: %v\n", stats["total_redactions"])
fmt.Printf("Active patterns: %v\n", stats["active_patterns"])

capabilities := provider.GetCapabilities()
fmt.Printf("Provider: %s v%s\n", capabilities.Name, capabilities.Version)
fmt.Printf("Supports policies: %v\n", capabilities.SupportsPolicies)

CLI Tool

The package includes a CLI tool for interactive redaction:

# Install CLI
go install github.com/censgate/redact/cmd/redactctl@latest

# Basic usage
redactctl redact "My email is john@example.com"

# With custom patterns
redactctl redact --pattern "ID-\d{6}" --mode mask "User ID-123456"

# Interactive mode
redactctl interactive

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines.

Development Setup

# Clone the repository
git clone https://github.com/censgate/redact.git
cd redact

# Install dependencies
go mod download

# Run tests
go test ./...

# Build CLI
go build -o redactctl ./cmd/redactctl

License

This project is licensed under the MIT License - see the LICENSE file for details.

Security

For security concerns, please see SECURITY.md.

Changelog

See CHANGELOG.md for a detailed history of changes.

Support

• Documentation: pkg.go.dev
• Issues: GitHub Issues
• Discussions: GitHub Discussions