Class: Lemans::SecretsFilter

Inherits:
Object
  • Object
show all
Defined in:
lib/lemans/secrets_filter.rb

Overview

Redacts known secret values (API credentials) from everything the store persists.

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(secrets, replacement: "<filtered>", min_length: 8) ⇒ SecretsFilter

Returns a new instance of SecretsFilter.



10
11
12
13
14
15
16
17
 
# File 'lib/lemans/secrets_filter.rb', line 10

def initialize(secrets, replacement: "<filtered>", min_length: 8)
  @replacement = replacement

  secrets = secrets.compact.uniq.select { it.length >= min_length }
  # Match bytes, not characters, so artifacts with non-UTF-8 content
  # (binary patch hunks) don't raise on scanning.
  @pattern = Regexp.union(secrets.map(&:b)) unless secrets.empty?
end

Class Method Details

.default ⇒ Object

Credentials follow the _ environment convention (DAYTONA_API_KEY, OPENROUTER_API_KEY, DAYTONA_TOKEN, ...).



8
 
# File 'lib/lemans/secrets_filter.rb', line 8

def self.default = new(ENV.filter_map { |name, value| value if name.match?(/_(API_KEY|TOKEN|SECRET|JWT)\z/) })

Instance Method Details

#filter(text) ⇒ Object 



19
20
21
22
23
 
# File 'lib/lemans/secrets_filter.rb', line 19

def filter(text)
  return text unless @pattern

  text.b.gsub(@pattern, @replacement)
end