Module: OpenAICompatibleErrors::Redaction

Defined in:
lib/openai_compatible_errors/redaction.rb

Defined Under Namespace

Classes: Limits

Constant Summary collapse

SENSITIVE_KEY = 
/(authorization|api[-_ ]?key|access[-_ ]?token|refresh[-_ ]?token|secret|password|cookie|prompt|completion)/i
REDACTED = 
"[REDACTED]".freeze
TRUNCATED = 
"[TRUNCATED]".freeze

Class Method Summary collapse

Class Method Details

.redact_sensitive_text(value, max_chars: 2_000) ⇒ Object 



24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
 
# File 'lib/openai_compatible_errors/redaction.rb', line 24

def redact_sensitive_text(value, max_chars: 2_000)
  return nil unless value.is_a?(String)

  text = value.encode("UTF-8", invalid: :replace, undef: :replace, replace: "�")
  replacements = 0
  patterns = [
    [/\bBearer\s+[A-Za-z0-9._~+\/=-]+/i, "Bearer #{REDACTED}"],
    [/\b(?:sk(?:-proj|-ant)?|xai|ghp|github_pat|hf|r8)[_-][A-Za-z0-9_-]{8,}/, REDACTED],
    [/(api[-_ ]?key|access[-_ ]?token|refresh[-_ ]?token|authorization)\s*[:=]\s*[^\s,;]+/i,
     "\\1=#{REDACTED}"]
  ]
  patterns.each do |pattern, replacement|
    text = text.gsub(pattern) do
      replacements += 1
      if replacement.include?("\\1")
        "#{Regexp.last_match(1)}=#{REDACTED}"
      else
        replacement
      end
    end
  end
  text = text.byteslice(0, max_chars).to_s.scrub
  replacements.positive? ? text : text
rescue EncodingError
  REDACTED
end

.sanitize_for_log(value, limits: Limits.new) ⇒ Object 



51
52
53
54
 
# File 'lib/openai_compatible_errors/redaction.rb', line 51

def sanitize_for_log(value, limits: Limits.new)
  state = { nodes: 0, chars: 0, replacements: 0, seen: {} }
  sanitize_value(value, depth: 0, limits: limits, state: state)
end

.sanitize_string(value, limits, state) ⇒ Object 



105
106
107
108
109
110
111
112
113
 
# File 'lib/openai_compatible_errors/redaction.rb', line 105

def sanitize_string(value, limits, state)
  text = redact_sensitive_text(value, max_chars: limits.max_chars)
  state[:chars] += text.to_s.length
  if state[:chars] > limits.max_chars
    state[:replacements] += 1
    return REDACTED
  end
  text
end

.sanitize_value(value, depth:, limits:, state:) ⇒ Object 



60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
 
# File 'lib/openai_compatible_errors/redaction.rb', line 60

def sanitize_value(value, depth:, limits:, state:)
  state[:nodes] += 1
  return REDACTED if state[:nodes] > limits.max_nodes
  return REDACTED if depth > limits.max_depth

  case value
  when nil, true, false, Numeric
    value
  when Symbol
    value.to_s
  when String
    sanitize_string(value, limits, state)
  when Exception
    "[#{value.class.name || "Exception"}]"
  when Hash
    return REDACTED if state[:seen][value.object_id]

    state[:seen][value.object_id] = true
    result = {}
    value.first(limits.max_keys).each do |key, item|
      normalized_key = key.is_a?(String) || key.is_a?(Symbol) ? key.to_s : "[KEY]"
      result[normalized_key] = if sensitive_key?(normalized_key)
                                 state[:replacements] += 1
                                 REDACTED
                               else
                                 sanitize_value(item, depth: depth + 1,
                                                limits: limits, state: state)
                               end
    end
    result["[TRUNCATED]"] = TRUNCATED if value.size > limits.max_keys
    result
  when Array
    return REDACTED if state[:seen][value.object_id]

    state[:seen][value.object_id] = true
    result = value.first(limits.max_items).map do |item|
      sanitize_value(item, depth: depth + 1, limits: limits, state: state)
    end
    result << TRUNCATED if value.size > limits.max_items
    result
  else
    "[#{value.class.name || "Object"}]"
  end
end

.sensitive_key?(key) ⇒ Boolean

Returns:

  • (Boolean) 


56
57
58
 
# File 'lib/openai_compatible_errors/redaction.rb', line 56

def sensitive_key?(key)
  key.is_a?(String) || key.is_a?(Symbol) ? key.to_s.match?(SENSITIVE_KEY) : false
end