datamasking

Documentation

Overview

Package datamasking erases selected data and composes encryption providers.

New creates a Masker. Masker.Erase replaces fields selected by EraseOptions using the default mask, a custom mask, a dynamic mask or a replacement callback. Ordered FieldRule entries control overlapping selectors. Operations work on private copies rather than mutating caller-owned payloads.

Providers and missing fields

Encryption and decryption use an application-supplied Provider, which owns ciphertext format and authenticated context. The optional datamasking/kms module implements that interface with the AWS Encryption SDK; erasure needs no provider.

Config.IgnoreMissing selects warning behavior for absent selectors. Strict mode reports missing fields. Null and Undefined retain their documented semantics. Review the guide for supported input types and selector syntax.

For usage and compatibility details, see the user guide.

Index

• Constants
• type Config
• type EraseOptions
• type Error
  • func (e *Error) Error() string
  • func (e *Error) ErrorName() string
  • func (e *Error) Unwrap() error
• type FieldRule
• type Masker
  • func New(config Config) *Masker
  • func (m *Masker) Decrypt(ctx context.Context, data any, options TransformOptions) (any, error)
  • func (m *Masker) Encrypt(ctx context.Context, data any, options TransformOptions) (any, error)
  • func (m *Masker) Erase(ctx context.Context, data any, options EraseOptions) (any, error)
• type Provider
• type Rule
• type TransformOptions
• type Undefined

Examples

• Masker.Erase

Constants

const DefaultMask = "*****"

Types

type Config

type Config struct {
	Provider      Provider
	IgnoreMissing bool
	Warn          func(context.Context, string)
}

type EraseOptions

type EraseOptions struct {
	Fields []string
	Rules  []FieldRule
	Rule   Rule
}

type Error

type Error struct {
	Name    string
	Message string
	Cause   error
}

func (*Error) Error

func (e *Error) Error() string

func (*Error) ErrorName

func (e *Error) ErrorName() string

func (*Error) Unwrap

func (e *Error) Unwrap() error

type FieldRule

type FieldRule struct {
	Field string
	Rule  Rule
}

FieldRule order is significant when expressions overlap.

type Masker

type Masker struct {
	// contains filtered or unexported fields
}

func New

func New(config Config) *Masker

func (*Masker) Decrypt

func (m *Masker) Decrypt(ctx context.Context, data any, options TransformOptions) (any, error)

func (*Masker) Encrypt

func (m *Masker) Encrypt(ctx context.Context, data any, options TransformOptions) (any, error)

func (*Masker) Erase

func (m *Masker) Erase(ctx context.Context, data any, options EraseOptions) (any, error)

Example

package main

import (
	"context"
	"fmt"

	"github.com/rambow-cloud/powertools-lambda-go/datamasking"
)

func main() {
	masker := datamasking.New(datamasking.Config{})
	input := map[string]any{"email": "user@example.com", "order": "order-123"}
	value, err := masker.Erase(context.Background(), input,
		datamasking.EraseOptions{Fields: []string{"email"}})
	if err != nil {
		panic(err)
	}
	masked := value.(map[string]any)
	fmt.Println(masked["email"], masked["order"])
	fmt.Println(input["email"])
}

Output:
***** order-123
user@example.com

type Provider

type Provider interface {
	Encrypt(context.Context, string, map[string]string) (string, error)
	Decrypt(context.Context, string, map[string]string) (string, error)
}

Provider owns ciphertext format, cryptography and authenticated context. Implementations must support concurrent calls and honor cancellation.

type Rule

type Rule struct {
	CustomMask  *string
	DynamicMask *bool
	Replace     func(string) (string, error)
}

Rule uses pointers to retain explicit false and empty custom masks. Replace is an application-owned string replacement strategy, with precedence over CustomMask and DynamicMask. The optional commons/regex module provides Regexp.Replacer for ECMAScript string replacement without a core dependency.

type TransformOptions

type TransformOptions struct {
	Fields  []string
	Context map[string]string
}

type Undefined

type Undefined struct{}

Undefined preserves missing JavaScript values separately from null.