Module: SmilyCli::Redaction

Defined in:
lib/smily_cli/redaction.rb

Overview

Scrubs secrets out of any text before it is written to a log or debug stream. --verbose wires the HTTP stacks' debug output through here so that access tokens, client secrets and refresh tokens never reach stderr in the clear (verbose output routinely ends up pasted into tickets/chat).

Defined Under Namespace

Classes: ScrubbedIO

Constant Summary collapse

PLACEHOLDER = 
"[REDACTED]"
PATTERNS =

Each pattern captures a leading label ($1) that is kept, and a secret value ($2) that is replaced.

[
  /(authorization:\s*bearer\s+)(\S+)/i,
  /(bearer\s+)([A-Za-z0-9._-]{6,})/i,
  /(access[_-]?token["'=:\s]+)([^&"'\s]+)/i,
  /(refresh[_-]?token["'=:\s]+)([^&"'\s]+)/i,
  /(client[_-]?secret["'=:\s]+)([^&"'\s]+)/i,
  /(mcp[_-]?token["'=:\s]+)([^&"'\s]+)/i
].freeze

Class Method Summary collapse

Class Method Details

.scrub(text) ⇒ String

Return text with any recognized secret replaced by PLACEHOLDER.

Parameters:

  • text (Object) —

    coerced to String

Returns:

  • (String) 


28
29
30
31
32
 
# File 'lib/smily_cli/redaction.rb', line 28

def scrub(text)
  PATTERNS.reduce(text.to_s) do |acc, pattern|
    acc.gsub(pattern) { "#{Regexp.last_match(1)}#{PLACEHOLDER}" }
  end
end

.stream(io) ⇒ ScrubbedIO

Wrap an IO so everything written to it is scrubbed first. Suitable for Net::HTTP#set_debug_output, which appends wire data via <</write.

Parameters:

  • io (IO)

Returns:



39
40
41
 
# File 'lib/smily_cli/redaction.rb', line 39

def stream(io)
  ScrubbedIO.new(io)
end