redact

Documentation

Overview

Package redact removes registered secret values from diagnostics and output.

Index

• Constants
• func SecretLikeName(name string) bool
• type Redactor
  • func New(secrets ...[]byte) *Redactor
  • func (r *Redactor) Add(secret []byte)
  • func (r *Redactor) Bytes(value []byte) []byte
  • func (r *Redactor) Clear()
  • func (r *Redactor) DiagnosticBytes(value []byte) []byte
  • func (r *Redactor) DiagnosticWriter(dst io.Writer) io.Writer
  • func (r *Redactor) String(value string) string
  • func (r *Redactor) Writer(dst io.Writer) io.Writer

Constants

const Replacement = "[REDACTED]"

Functions

func SecretLikeName

func SecretLikeName(name string) bool

SecretLikeName reports whether a diagnostic key resembles a credential container. It deliberately matches components rather than substrings so harmless names such as MONKEY and TOKENIZER are not redacted.

Types

type Redactor

type Redactor struct {
	// contains filtered or unexported fields
}

Redactor is safe for concurrent use. Registered values are copied.

func New

func New(secrets ...[]byte) *Redactor

func (*Redactor) Add

func (r *Redactor) Add(secret []byte)

Add registers a secret and common encoded representations of it.

func (*Redactor) Bytes

func (r *Redactor) Bytes(value []byte) []byte

func (*Redactor) Clear

func (r *Redactor) Clear()

Clear overwrites and forgets all registered representations.

func (*Redactor) DiagnosticBytes

func (r *Redactor) DiagnosticBytes(value []byte) []byte

DiagnosticBytes redacts registered values and secret-shaped assignments.

func (*Redactor) DiagnosticWriter

func (r *Redactor) DiagnosticWriter(dst io.Writer) io.Writer

DiagnosticWriter returns a writer suitable for logs and diagnostics. In addition to registered secret values, it removes values assigned to secret-like environment variable names and values stored under secret-like JSON object keys. This is a final safety boundary: callers should still avoid passing credentials to a logger in the first place.

Callers should write complete records. Like Writer, this wrapper cannot recognize a value split across multiple writes.

func (*Redactor) String

func (r *Redactor) String(value string) string

func (*Redactor) Writer

func (r *Redactor) Writer(dst io.Writer) io.Writer

Writer returns a writer that redacts each Write call before forwarding it. Callers should write complete diagnostic records because a secret split across multiple writes cannot be recognized.