ForgeOpsTracker.PiiScrubber (forge_ops_tracker v0.1.0)

Copy Markdown View Source

Redacts likely-sensitive content out of a payload before it ever leaves this process -- the same patterns ForgeOps itself applies again on arrival (defense in depth: this layer keeps the data off the wire and out of any request logging in between; the server-side layer is what actually protects the database, and doesn't depend on every reporting app running an up-to-date version of this client). Ported from gems/forge_ops_tracker/lib/forge_ops_tracker/pii_scrubber.rb -- same key list, same 8 regex patterns, unmodified from the Ruby original: Elixir's Regex is Erlang's :re module, itself a PCRE implementation, so unlike this repo's own C client (which had to adapt every pattern to POSIX Extended Regular Expressions -- no \d/\s/\b), nothing here needed translating.

Can be turned off via Configuration.scrub_pii = false for a host app that already scrubs its own data before it ever reaches error context, or that has its own reasons to want the raw payload. Off by default is not an option: the safe default has to be "on."

Summary

Functions

Redacts value based on key (an entire value redacted wholesale if key looks sensitive, regardless of type) and recurses into maps/lists, matching every other client's behavior in this repo. key is the enclosing map key value was found under (nil for a bare top-level value or a list element), and is what the key-name check runs against.

Runs every pattern above over a single string, independent of any key -- used both directly (a message, a stack frame's file/method) and as the leaf case of scrub/2 below.

Functions

redacted()

scrub(value, key \\ nil)

@spec scrub(term(), String.t() | atom() | nil) :: term()

Redacts value based on key (an entire value redacted wholesale if key looks sensitive, regardless of type) and recurses into maps/lists, matching every other client's behavior in this repo. key is the enclosing map key value was found under (nil for a bare top-level value or a list element), and is what the key-name check runs against.

scrub_string(text)

@spec scrub_string(String.t()) :: String.t()

Runs every pattern above over a single string, independent of any key -- used both directly (a message, a stack frame's file/method) and as the leaf case of scrub/2 below.