Class: Olyx::Guardrails::SecretScanner

Inherits:
Object
  • Object
show all
Defined in:
lib/olyx/guardrails/secret_scanner.rb

Overview

Detects, redacts, or rejects documented credential and internal-endpoint formats.

Public findings contain a masked value, fingerprint, category, and source offsets. They never contain the complete matched credential.

Constant Summary collapse

Blocked =

Raised by scan! when one or more safe secret findings exist. Instances expose findings and the inherited decision summary.

Secrets::Blocked

Class Method Summary collapse

Class Method Details

.redact(text, custom_patterns: []) ⇒ Object

:call-seq:

SecretScanner.redact(text, custom_patterns: []) -> Hash

Converts text with to_s and returns transformed :text, a :leaked Boolean, and safe :findings. A confidentiality marker redacts the complete input because the marker does not identify one safe span.



37
38
39
40
41
42
43
44
45
 
# File 'lib/olyx/guardrails/secret_scanner.rb', line 37

def self.redact(text, custom_patterns: [])
  source = text.to_s
  findings = collect(source, custom_patterns)
  {
    text: findings.empty? ? source : Secrets::Redactor.call(source, findings),
    leaked: findings.any?,
    findings: Secrets::FindingPresenter.call(findings)
  }
end

.scan(text, custom_patterns: []) ⇒ Object

:call-seq:

SecretScanner.scan(text, custom_patterns: []) -> Hash

Converts text with to_s and returns a :leaked Boolean with safe :findings. custom_patterns must be an Array of regular-expression source Strings. Invalid patterns raise ArgumentError.



26
27
28
29
 
# File 'lib/olyx/guardrails/secret_scanner.rb', line 26

def self.scan(text, custom_patterns: [])
  findings = collect(text, custom_patterns)
  { leaked: findings.any?, findings: Secrets::FindingPresenter.call(findings) }
end

.scan!(text, custom_patterns: []) ⇒ Object

:call-seq:

SecretScanner.scan!(text, custom_patterns: []) -> Hash

Returns the same result as scan when no finding exists. Raises SecretScanner::Blocked with safe findings when a secret is detected.

Raises:



52
53
54
55
56
57
 
# File 'lib/olyx/guardrails/secret_scanner.rb', line 52

def self.scan!(text, custom_patterns: [])
  result = scan(text, custom_patterns: custom_patterns)
  raise Blocked, result[:findings] if result[:leaked]

  result
end