Redaction

Generated from the type stubs and docstrings. Do not edit by hand.

Types

RedactionPolicy

Configure additions and exemptions for the built-in redaction policy.

extra_keys are more secret field names, matched as dict keys and as name=value in free text. never_redact_keys are field names never masked by name (a false-positive escape hatch; a secret-shaped value inside such a field is still masked). extra_value_patterns mask whatever they match in any string.

mask is a deployment’s own callback, run once on the whole payload inside redact_deep - after the built-in redaction, so it only ever sees already-masked data, and before any egress size cap. If it raises, the payload is replaced by MASK_FAILED; raw data never ships because of a bug in this callback.

Fields:

• extra_keys: tuple[str, ...] = ()
• never_redact_keys: tuple[str, ...] = ()
• extra_value_patterns: tuple[re.Pattern[str], ...] = ()
• mask: Optional[Callable[[Any], Any]] = None

Constants

• REDACTED = '[REDACTED]'

Functions

redact

redact(value: Any) -> Any

Recursively replace secret-shaped values. Never mutates the input.

Masks keys only. Use redact_text for secrets embedded in free text.

redact_text

redact_text(text: str) -> str

Mask secret-shaped substrings in free text (exception messages).

Deliberately narrow: inline URL credentials, key=value pairs whose key is secret-shaped, and secrets with a recognisable shape of their own. A hygiene pass, not a guarantee - a bare secret with no surrounding shape still gets through, which is why detail is also capped.

redaction_policy

redaction_policy() -> RedactionPolicy

The policy every egress path applies now.

The one passed to set_redaction_policy, or else the default: the built-in rules plus the names in PYRULA_REDACT_KEYS, read on each call.

reset_redaction_policy

reset_redaction_policy() -> None

Drop a policy set in code, returning to the one PYRULA_REDACT_KEYS gives.

set_redaction_policy

set_redaction_policy(policy: RedactionPolicy) -> None

Install policy for the whole process, like logging configuration.

It replaces the default read from PYRULA_REDACT_KEYS rather than adding to it; build from redaction_policy() to keep those keys.