Class: Reeve::Audit::Redactor

Inherits:
Object
  • Object
show all
Defined in:
lib/reeve/audit/redactor.rb

Overview

Removes declared-sensitive values from the arguments before they are written (FR-011).

Names always survive: an entry that cannot say which argument was passed answers nothing after an incident. Values of declared names are replaced, recursively, wherever they appear. Matching is on the name, never on the value — pattern-sniffing a compliance artifact both misses and over-matches (R6).

The input is never mutated and never stored: the redacted hash is a new structure, so no unredacted copy exists downstream of this object.

Constant Summary collapse

MARKER = 
"[REDACTED]"

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(names, marker: MARKER) ⇒ Redactor

Returns a new instance of Redactor.



33
34
35
36
 
# File 'lib/reeve/audit/redactor.rb', line 33

def initialize(names, marker: MARKER)
  @names  = Array(names).map { |name| name.to_s.downcase }.uniq.freeze
  @marker = marker
end

Class Method Details

.for(tool_name, config: Reeve.config, registry: Audit.guard_registry) ⇒ Object

The names declared globally, plus the ones this tool's own guard declared.



19
20
21
 
# File 'lib/reeve/audit/redactor.rb', line 19

def self.for(tool_name, config: Reeve.config, registry: Audit.guard_registry)
  new(Array(config.redact_arguments) + tool_names(tool_name, registry))
end

Instance Method Details

#call(arguments) ⇒ Object 



38
39
40
41
42
 
# File 'lib/reeve/audit/redactor.rb', line 38

def call(arguments)
  return {} if arguments.nil?

  redact_hash(arguments)
end