Module: Nfe::Http::Redactor

Defined in:
lib/nfe/http/redactor.rb,
sig/nfe/http/redactor.rbs

Overview

Replaces the values of sensitive headers with "[REDACTED]" before they reach a log line, so an API key, bearer token, or idempotency key never appears verbatim in transport logs.

A header is considered sensitive when its (case-insensitive) name is one of x-nfe-apikey, authorization, idempotency-key, or matches /secret|apikey|token/i. Benign headers are returned unchanged.

Constant Summary collapse

REDACTED =

Returns:

  • (String) 
"[REDACTED]"
SENSITIVE_NAMES =

Exact (case-insensitive) header names that are always redacted.

Returns:

  • (Array[String]) 
%w[x-nfe-apikey authorization idempotency-key].freeze
SENSITIVE_PATTERN =

Substring pattern matched against header names.

Returns:

  • (Regexp) 
/secret|apikey|token/i

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.headers(hash) ⇒ Object

Returns a new Hash with the values of sensitive keys replaced by "[REDACTED]". The input hash is never mutated; benign keys keep their original value and casing.



26
27
28
29
30
31
32
 
# File 'lib/nfe/http/redactor.rb', line 26

def headers(hash)
  return hash unless hash.respond_to?(:each_pair)

  redacted = {} #: Hash[untyped, untyped]
  hash.each_pair { |key, value| redacted[key] = sensitive?(key) ? REDACTED : value }
  redacted
end

.sensitive?(key) ⇒ Boolean

Returns true when a header named key must have its value redacted.

Returns:

  • (Boolean) 


35
36
37
38
 
# File 'lib/nfe/http/redactor.rb', line 35

def sensitive?(key)
  name = key.to_s.downcase
  SENSITIVE_NAMES.include?(name) || SENSITIVE_PATTERN.match?(name)
end

Instance Method Details

#self?.headers ⇒ Hash[untyped, untyped]

Parameters:

  • hash (Object)

Returns:

  • (Hash[untyped, untyped]) 


8
 
# File 'sig/nfe/http/redactor.rbs', line 8

def self?.headers: (untyped hash) -> Hash[untyped, untyped]

#self?.sensitive? ⇒ Boolean

Parameters:

  • key (Object)

Returns:

  • (Boolean) 


9
 
# File 'sig/nfe/http/redactor.rbs', line 9

def self?.sensitive?: (untyped key) -> bool