mask

Documentation

Overview

Package mask hides secret values in everything Probe prints or writes.

Index

• func HoldsCredential(key string) bool
• func HoldsURL(key string) bool
• func Userinfo(rawURL string) string
• type Masker
  • func New(secrets []string, env map[string]string) *Masker
  • func (m *Masker) Learn(data map[string]any)
  • func (m *Masker) Map(data map[string]any) map[string]any
  • func (m *Masker) String(s string) string
  • func (m *Masker) Writer(w io.Writer) io.Writer

Functions

func HoldsCredential

func HoldsCredential(key string) bool

HoldsCredential reports whether the parameter or header named key holds a credential, whole or, as a database URL does, in part. A message about such a value, such as why its template could not be evaluated, must not show what was written there.

func HoldsURL

func HoldsURL(key string) bool

HoldsURL reports whether the parameter named key holds a URL whose password is a credential, as dsn and url do.

func Userinfo

func Userinfo(rawURL string) string

Userinfo returns the user info of a URL, what stands between its scheme and the last @ of its authority, as user:password, or nothing when it has none. It does not rely on url.Parse, which rejects the tcp(host:port) address a MySQL DSN may carry.

Types

type Masker

type Masker struct {
	// contains filtered or unexported fields
}

Masker hides secret values in everything Probe prints or writes. It starts with the secrets the workflow declares and learns the values of credential headers as actions are about to send them, so that a token obtained at run time is hidden too. A nil Masker hides only credential headers in the maps passed to Map, and learns nothing.

func New

func New(secrets []string, env map[string]string) *Masker

New builds a Masker for the environment variables named in secrets. Each value is replaced by <secret:NAME>. A name that is not set, or set to an empty string, has nothing to hide and is skipped.

func (*Masker) Learn

func (m *Masker) Learn(data map[string]any)

Learn registers the values of credential headers and parameters found anywhere in data, and the password in a database URL, so that they are hidden from then on. It is called with an action's parameters before the action runs, which is what keeps them out of the action's own log records.

func (*Masker) Map

func (m *Masker) Map(data map[string]any) map[string]any

Map returns a copy of a request or response with secret values hidden in every string, and the values of credential headers replaced outright. The original is left untouched, since tests and outputs still need the real values. A nil map stays nil.

func (*Masker) String

func (m *Masker) String(s string) string

String hides every secret value in s.

func (*Masker) Writer

func (m *Masker) Writer(w io.Writer) io.Writer

Writer wraps w so that secret values are hidden in what is written to it. Every caller writes whole messages or lines, so a value is never split across two writes. The wrapper consults the masker on each write, so values learned later are hidden too.