Redact

1// Redact credentials and PII before persisting samples or schema-derived bodies.
2// All redactions replace values in-place with the literal string "<redacted>"
3// so downstream schema inference still sees a string and types stay coherent.
4
5const HEADER_DENY = new Set([
6  'authorization', 'cookie', 'set-cookie', 'x-csrf-token', 'x-xsrf-token',
7  'x-api-key', 'proxy-authorization',
8]);
9
10const HEADER_PATTERNS = [/token/i, /secret/i, /signature/i, /session/i];
11
12const KEY_DENY = new Set([
13  'password', 'token', 'secret', 'api_key', 'apikey',
14  'accesstoken', 'refreshtoken', 'creditcard', 'ssn',
15]);
16
17const JWT_RE = /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
18const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
19const PHONE_RE = /^\+?[0-9][0-9\s().-]{6,}[0-9]$/;
20
21export function makeRedactor({ extra = [] } = {}) {
22  const extraHeaders = new Set();
23  const extraKeys = new Set();
24  for (const e of extra) {
25    const k = e.toLowerCase();
26    extraHeaders.add(k);
27    extraKeys.add(k);
28  }
29  const counts = { headers: 0, bodyKeys: 0, bodyValues: 0 };
30
31  function isHeaderSecret(name) {
32    const k = name.toLowerCase();
33    if (HEADER_DENY.has(k) || extraHeaders.has(k)) return true;
34    return HEADER_PATTERNS.some(re => re.test(k));
35  }
36
37  function isKeySecret(name) {
38    const k = String(name).toLowerCase().replace(/[_-]/g, '');
39    return KEY_DENY.has(k) || extraKeys.has(k);
40  }
41
42  function isValueSecret(v) {
43    if (typeof v !== 'string') return false;
44    if (v.length < 6) return false;
45    return JWT_RE.test(v) || EMAIL_RE.test(v) || PHONE_RE.test(v);
46  }
47
48  function redactHeaders(h) {
49    if (!h || typeof h !== 'object') return h;
50    const out = {};
51    for (const [k, v] of Object.entries(h)) {
52      if (isHeaderSecret(k)) { out[k] = '<redacted>'; counts.headers++; }
53      else out[k] = v;
54    }
55    return out;
56  }
57
58  function redactBody(node) {
59    if (Array.isArray(node)) return node.map(redactBody);
60    if (node && typeof node === 'object') {
61      const out = {};
62      for (const [k, v] of Object.entries(node)) {
63        if (isKeySecret(k)) { out[k] = '<redacted>'; counts.bodyKeys++; }
64        else out[k] = redactBody(v);
65      }
66      return out;
67    }
68    if (isValueSecret(node)) { counts.bodyValues++; return '<redacted>'; }
69    return node;
70  }
71
72  return { redactHeaders, redactBody, counts };
73}