redact.go RawHistoryFolder

1package domain
2
3import "regexp"
4
5type secretRedactionPattern struct {
6	re   *regexp.Regexp
7	repl string
8}
9
10const secretKeyPattern = `[A-Z0-9_]*(?:PASSWORD|TOKEN|SECRET|API[_-]?KEY|DATABASE[_-]?URL)[A-Z0-9_]*` //nolint:gosec // Regex pattern for secret-like key names, not a credential.
11
12var secretValuePatterns = []secretRedactionPattern{
13	{
14		re:   regexp.MustCompile(`(?i)(\b` + secretKeyPattern + `\b\s*=\s*)(?:"(?:\\.|[^"])*"|'(?:\\.|[^'])*'|[^\s]+)`),
15		repl: `${1}[REDACTED]`,
16	},
17	{
18		re:   regexp.MustCompile(`(?i)("` + secretKeyPattern + `"\s*:\s*")((?:\\.|[^"])*)(")`),
19		repl: `${1}[REDACTED]${3}`,
20	},
21	{
22		re:   regexp.MustCompile(`(?i)(\bAuthorization\s*:\s*Bearer\s+)([^\s]+)`),
23		repl: `${1}[REDACTED]`,
24	},
25}
26
27// RedactSecrets redacts common secret values from a single log or diagnostic line.
28func RedactSecrets(line string) string {
29	redacted := line
30	for _, pattern := range secretValuePatterns {
31		redacted = pattern.re.ReplaceAllString(redacted, pattern.repl)
32	}
33	return redacted
34}
35
36// RedactSecretLines redacts common secret values from log or diagnostic lines.
37func RedactSecretLines(lines []string) []string {
38	if lines == nil {
39		return nil
40	}
41	redacted := make([]string, len(lines))
42	for i, line := range lines {
43		redacted[i] = RedactSecrets(line)
44	}
45	return redacted
46}