analytics_ops 0.1.0 → 0.2.0

data/lib/analytics_ops/clients/data.rb

@@ -30,14 +30,15 @@ module AnalyticsOps
         potentially_thresholded_requests_per_hour
       ].freeze
 
-      def initialize(client: nil, credentials: nil, transport: :grpc, timeout: nil, logger: nil)
-        transport = transport.to_sym
-        raise ConfigurationError, "transport must be grpc or rest" unless %i[grpc rest].include?(transport)
+      def initialize(client: nil, service_account: nil, transport: :grpc, timeout: nil, logger: nil)
+        unless service_account.nil? || service_account.is_a?(ServiceAccount)
+          raise ConfigurationError, "service_account must be an AnalyticsOps::ServiceAccount"
+        end
 
         @client = client
-        @credentials = credentials
-        @transport = transport
-        @timeout = timeout
+        @service_account = service_account
+        @transport = validate_transport(transport)
+        @timeout = validate_timeout(timeout)
         @logger = logger
       end
 
@@ -55,20 +56,37 @@ module AnalyticsOps
         normalize_result(definition, response)
       end
 
+      def batch(property_id, definitions)
+        validate_batch_definitions!(definitions)
+
+        property = property_name(property_id)
+        requests = definitions.map do |definition|
+          standard_request(property_id, definition).reject { |key| key == :property }
+        end
+        response = invoke(:batch_run_reports, property:, requests:)
+        reports = array_field(response, :reports)
+        unless reports.length == definitions.length
+          raise RemoteError, "Google Data API returned a batch size that does not match the request"
+        end
+
+        definitions.zip(reports).map { |definition, report| normalize_result(definition, report) }.freeze
+      end
+
       def available?
         generated_client = translate_errors { client }
-        generated_client.respond_to?(:run_report) && generated_client.respond_to?(:run_realtime_report)
+        generated_client.respond_to?(:run_report) && generated_client.respond_to?(:run_realtime_report) &&
+          generated_client.respond_to?(:batch_run_reports)
       end
 
       def compatibility
         specification = Gem::Specification.find_by_name("google-analytics-data")
-        {
+        Canonical.immutable(
           "package" => specification.name,
           "version" => specification.version.to_s,
           "requirement" => PACKAGE_REQUIREMENT.to_s,
           "supported" => PACKAGE_REQUIREMENT.satisfied_by?(specification.version),
           "transport" => @transport.to_s
-        }.freeze
+        )
       rescue Gem::LoadError => error
         raise UnsupportedCapabilityError, Redaction.message(error.message)
       end
@@ -77,16 +95,20 @@ module AnalyticsOps
 
       def client
         @client ||= begin
+          unless @service_account
+            raise AuthenticationError, "Analytics Ops requires configured service-account credentials"
+          end
+
           require "google/analytics/data"
           Google::Analytics::Data.analytics_data(transport: @transport) do |config|
-            config.credentials = @credentials if @credentials
+            config.credentials = @service_account.__send__(:credentials, access: :read)
             config.timeout = @timeout if @timeout
           end
         end
       end
 
       def standard_request(property_id, definition)
-        common_request(property_id, definition).merge(
+        request = common_request(property_id, definition).merge(
           offset: definition.offset,
           date_ranges: definition.date_ranges.map do |range|
             {
@@ -96,6 +118,8 @@ module AnalyticsOps
             }.compact
           end
         )
+        request[:keep_empty_rows] = true if definition.dimensions.empty?
+        request
       end
 
       def realtime_request(property_id, definition)
@@ -175,34 +199,31 @@ module AnalyticsOps
         translate_errors { generated_client.public_send(method_name, request) }
       end
 
-      def translate_errors
-        yield
-      rescue AnalyticsOps::Error
-        raise
-      rescue StandardError => error
-        translated = case error.class.name
-                     when /Unauthenticated|Google::Auth|Signet::Authorization/
-                       AuthenticationError
-                     when /PermissionDenied|Forbidden/
-                       AuthorizationError
-                     when /ResourceExhausted|TooManyRequests/
-                       QuotaError
-                     when /DeadlineExceeded|Timeout|ETIMEDOUT/
-                       TimeoutError
-                     when /InvalidArgument|FailedPrecondition|NotFound/
-                       InvalidRequestError
-                     when /Google::Cloud::|GRPC::|Faraday::|HTTP/
-                       RemoteError
-                     end
-        raise unless translated
-
-        raise translated, Redaction.message(error.message)
+      def translate_errors(&)
+        ErrorTranslation.call(&)
+      end
+
+      def validate_batch_definitions!(definitions)
+        valid = definitions.is_a?(Array) &&
+                definitions.length.between?(1, Reports::OverviewResult::MAX_REPORTS) &&
+                definitions.all? { |definition| definition.is_a?(Reports::Definition) && !definition.realtime? }
+        raise InvalidRequestError, "batch must contain 1 to 5 standard report definitions" unless valid
+
+        return if definitions.map(&:name).uniq.length == definitions.length
+
+        raise InvalidRequestError, "batch report definitions must have unique names"
       end
 
       def normalize_result(definition, response)
-        dimension_headers = array_field(response, :dimension_headers).map { |header| field(header, :name).to_s }
-        metric_headers = array_field(response, :metric_headers).map { |header| field(header, :name).to_s }
-        unless dimension_headers == definition.dimensions && metric_headers == definition.metrics
+        dimension_headers = array_field(response, :dimension_headers).map do |header|
+          remote_string(field(header, :name), "dimension header")
+        end
+        metric_headers = array_field(response, :metric_headers).map do |header|
+          remote_string(field(header, :name), "metric header")
+        end
+        expected_dimensions = definition.dimensions.dup
+        expected_dimensions << "dateRange" if definition.date_ranges.length > 1
+        unless dimension_headers == expected_dimensions && metric_headers == definition.metrics
           raise RemoteError, "Google Data API returned headers that do not match the requested report"
         end
 
@@ -228,28 +249,31 @@ module AnalyticsOps
       end
 
       def values(row, name)
-        array_field(row, name).map { |value| field(value, :value).to_s }
+        array_field(row, name).map { |value| remote_string(field(value, :value), "row value") }
       end
 
       def metadata(response)
         response_metadata = field(response, :metadata)
-        result = {
-          "data_loss_from_other_row" => boolean?(field(response_metadata, :data_loss_from_other_row)),
-          "subject_to_thresholding" => boolean?(field(response_metadata, :subject_to_thresholding)),
-          "currency_code" => optional_string(field(response_metadata, :currency_code)),
-          "time_zone" => optional_string(field(response_metadata, :time_zone)),
-          "empty_reason" => optional_string(field(response_metadata, :empty_reason)),
-          "sampling" => sampling(response_metadata),
-          "property_quota" => quota(field(response, :property_quota))
-        }
+        result = {}
+        if response_metadata
+          result = {
+            "data_loss_from_other_row" => metadata_boolean(field(response_metadata, :data_loss_from_other_row)),
+            "subject_to_thresholding" => metadata_boolean(field(response_metadata, :subject_to_thresholding)),
+            "currency_code" => optional_string(field(response_metadata, :currency_code), "currency code"),
+            "time_zone" => optional_string(field(response_metadata, :time_zone), "time zone"),
+            "empty_reason" => optional_string(field(response_metadata, :empty_reason), "empty reason"),
+            "sampling" => sampling(response_metadata)
+          }
+        end
+        result["property_quota"] = quota(field(response, :property_quota))
         result.reject { |_key, value| value.nil? || value == [] }
       end
 
       def sampling(response_metadata)
         array_field(response_metadata, :sampling_metadatas).map do |sample|
           {
-            "samples_read_count" => integer(field(sample, :samples_read_count), 0),
-            "sampling_space_size" => integer(field(sample, :sampling_space_size), 0)
+            "samples_read_count" => nonnegative_integer(field(sample, :samples_read_count), "sampling counter"),
+            "sampling_space_size" => nonnegative_integer(field(sample, :sampling_space_size), "sampling counter")
           }
         end
       end
@@ -262,17 +286,18 @@ module AnalyticsOps
           next unless status
 
           result[name.to_s] = {
-            "consumed" => integer(field(status, :consumed), 0),
-            "remaining" => integer(field(status, :remaining), 0)
+            "consumed" => nonnegative_integer(field(status, :consumed), "quota counter"),
+            "remaining" => nonnegative_integer(field(status, :remaining), "quota counter")
           }
         end
       end
 
       def property_name(property_id)
-        id = property_id.to_s
-        raise ConfigurationError, "Invalid property ID" unless id.match?(/\A\d{1,50}\z/)
+        unless property_id.is_a?(String) && property_id.match?(/\A\d{1,50}\z/)
+          raise ConfigurationError, "Invalid property ID; expected a numeric string"
+        end
 
-        "properties/#{id}"
+        "properties/#{property_id}"
       end
 
       def field(value, name)
@@ -288,26 +313,58 @@ module AnalyticsOps
         Array(field(value, name))
       end
 
-      def optional_string(value)
-        string = value.to_s
+      def optional_string(value, label)
+        return nil if value.nil?
+
+        string = remote_string(value, label)
         string.empty? ? nil : string
       end
 
-      def integer(value, default)
-        value.nil? ? default : Integer(value)
-      rescue ArgumentError, TypeError
-        default
+      def remote_string(value, label)
+        raise RemoteError, "Google Data API returned an invalid #{label}" unless value.is_a?(String)
+
+        string = value.encode(Encoding::UTF_8)
+        raise EncodingError unless string.valid_encoding?
+
+        string
+      rescue EncodingError
+        raise RemoteError, "Google Data API returned an invalid #{label}"
+      end
+
+      def nonnegative_integer(value, label)
+        return 0 if value.nil?
+        return value if value.is_a?(Integer) && !value.negative?
+
+        raise RemoteError, "Google Data API returned an invalid #{label}"
       end
 
       def response_row_count(response, default)
         value = field(response, :row_count)
-        value.nil? ? default : Integer(value)
-      rescue ArgumentError, TypeError
+        return default if value.nil?
+        return value if value.is_a?(Integer) && !value.negative?
+
         raise RemoteError, "Google Data API returned an invalid row count"
       end
 
-      def boolean?(value)
-        value == true
+      def metadata_boolean(value)
+        return false if value.nil?
+        return value if [true, false].include?(value)
+
+        raise RemoteError, "Google Data API returned an invalid metadata boolean"
+      end
+
+      def validate_transport(value)
+        transport = value.to_sym if value.respond_to?(:to_sym)
+        return transport if %i[grpc rest].include?(transport)
+
+        raise ConfigurationError, "transport must be grpc or rest"
+      end
+
+      def validate_timeout(value)
+        return nil if value.nil?
+        return value if [Integer, Float].any? { |type| value.is_a?(type) } && value.finite? && value.positive?
+
+        raise ConfigurationError, "timeout must be a finite positive number"
       end
     end
   end

data/lib/analytics_ops/clients/error_translation.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module AnalyticsOps
+  module Clients
+    # Shared fail-closed mapping from official-client transport failures to public gem errors.
+    module ErrorTranslation
+      NETWORK_FAILURE = /
+        Google::Cloud::|GRPC::|Gapic::|Faraday::|HTTP|SocketError|EOFError|OpenSSL::SSL::|
+        Errno::E(?:PIPE|CONNABORTED|CONNRESET|CONNREFUSED|HOSTUNREACH|NETUNREACH|ADDRNOTAVAIL)
+      /x
+
+      module_function
+
+      def call
+        yield
+      rescue AnalyticsOps::Error
+        raise
+      rescue StandardError => error
+        translated = error_class(error.class.name)
+        raise unless translated
+
+        raise translated, Redaction.message(error.message)
+      end
+
+      def error_class(name)
+        case name
+        when /Unauthenticated|Google::Auth|Signet::Authorization|Gapic::UniverseDomainMismatch/
+          AuthenticationError
+        when /PermissionDenied|Forbidden/
+          AuthorizationError
+        when /ResourceExhausted|TooManyRequests/
+          QuotaError
+        when /DeadlineExceeded|Timeout|ETIMEDOUT/
+          TimeoutError
+        when /InvalidArgument|FailedPrecondition|NotFound|AlreadyExists|Google::Protobuf::/
+          InvalidRequestError
+        when NETWORK_FAILURE
+          RemoteError
+        end
+      end
+      private_class_method :error_class
+    end
+    private_constant :ErrorTranslation
+  end
+end

data/lib/analytics_ops/configuration/document.rb

@@ -10,7 +10,7 @@ module AnalyticsOps
 
       def initialize(version:, profiles:)
         @version = version
-        @profiles = Canonical.deep_freeze(profiles)
+        @profiles = Canonical.immutable(profiles)
         freeze
       end
 

data/lib/analytics_ops/configuration/loader.rb

@@ -9,6 +9,7 @@ module AnalyticsOps
     # Bounded safe-YAML reader with allowlisted environment interpolation.
     class Loader
       MAX_BYTES = 1_048_576
+      MAX_NESTING = 50
       VARIABLE = /\$\{([A-Z][A-Z0-9_]*)\}/
 
       def initialize(environment: ENV)
@@ -19,6 +20,8 @@ module AnalyticsOps
         source = read(path)
         raise ConfigurationError, "ERB is not allowed in Analytics Ops configuration" if source.include?("<%")
 
+        reject_duplicate_mapping_keys!(source)
+
         parsed = Psych.safe_load(
           source,
           permitted_classes: [],
@@ -30,7 +33,8 @@ module AnalyticsOps
 
         Validator.new(interpolate(parsed)).call
       rescue Psych::Exception => error
-        raise ConfigurationError, "Invalid YAML in #{path}: #{error.message}"
+        raise ConfigurationError,
+              "Invalid YAML in #{Redaction.message(path)}: #{Redaction.message(error.message)}"
       end
 
       private
@@ -41,7 +45,8 @@ module AnalyticsOps
 
         contents
       rescue SystemCallError => error
-        raise ConfigurationError, "Cannot read configuration #{path}: #{error.message}"
+        raise ConfigurationError,
+              "Cannot read configuration #{Redaction.message(path)}: #{Redaction.message(error.message)}"
       end
 
       def interpolate(value)
@@ -57,6 +62,36 @@ module AnalyticsOps
         end
       end
 
+      def reject_duplicate_mapping_keys!(source)
+        visit_yaml_node(Psych.parse_stream(source))
+      end
+
+      def visit_yaml_node(node, depth = 0)
+        raise ConfigurationError, "Configuration YAML nesting exceeds #{MAX_NESTING}" if depth > MAX_NESTING
+
+        if node.is_a?(Psych::Nodes::Mapping)
+          visit_yaml_mapping(node, depth)
+        elsif node.respond_to?(:children)
+          Array(node.children).each { |child| visit_yaml_node(child, depth + 1) }
+        end
+      end
+
+      def visit_yaml_mapping(node, depth)
+        keys = {}
+        node.children.each_slice(2) do |key, value|
+          if key.is_a?(Psych::Nodes::Scalar)
+            duplicate = keys.key?(key.value)
+            keys[key.value] = true
+            if duplicate
+              label = Redaction.message(key.value.inspect)
+              raise ConfigurationError, "Duplicate YAML mapping key #{label}"
+            end
+          end
+          visit_yaml_node(key, depth + 1)
+          visit_yaml_node(value, depth + 1)
+        end
+      end
+
       def interpolate_string(value)
         result = value.gsub(VARIABLE) do
           name = Regexp.last_match(1)
@@ -65,9 +100,7 @@ module AnalyticsOps
           @environment.fetch(name).to_s
         end
 
-        if result.include?("${")
-          raise EnvironmentVariableError, "Malformed environment interpolation in #{value.inspect}"
-        end
+        raise EnvironmentVariableError, "Malformed environment interpolation" if result.include?("${")
 
         result
       end

data/lib/analytics_ops/configuration/schema.rb

@@ -69,11 +69,12 @@ module AnalyticsOps
           "required" => %w[event_data user_data reset_on_new_activity],
           "properties" => {
             "event_data" => { "$ref" => "#/$defs/retentionValue" },
-            "user_data" => { "$ref" => "#/$defs/retentionValue" },
+            "user_data" => { "$ref" => "#/$defs/userRetentionValue" },
             "reset_on_new_activity" => { "type" => "boolean" }
           }
         },
         "retentionValue" => { "enum" => Configuration::Validator::RETENTION_VALUES },
+        "userRetentionValue" => { "enum" => Configuration::Validator::USER_RETENTION_VALUES },
         "googleSignals" => {
           "type" => "object", "additionalProperties" => false,
           "required" => %w[state experimental],
@@ -84,22 +85,64 @@ module AnalyticsOps
           "required" => %w[parameter_name display_name scope],
           "properties" => {
             "parameter_name" => { "type" => "string", "pattern" => "^[A-Za-z][A-Za-z0-9_]{0,39}$" },
-            "display_name" => { "type" => "string", "minLength" => 1, "maxLength" => 82 },
-            "description" => { "type" => "string", "maxLength" => 150 },
+            "display_name" => {
+              "type" => "string", "pattern" => "^[A-Za-z][A-Za-z0-9_ ]{0,81}$"
+            },
+            "description" => {
+              "type" => "string", "maxLength" => 150, "pattern" => "^[^\\u0000-\\u001F\\u007F]*$"
+            },
             "scope" => { "enum" => Configuration::Validator::DIMENSION_SCOPES },
             "disallow_ads_personalization" => { "type" => "boolean" }
-          }
+          },
+          "allOf" => [
+            {
+              "if" => { "properties" => { "scope" => { "const" => "user" } } },
+              "then" => {
+                "properties" => {
+                  "parameter_name" => { "type" => "string", "pattern" => "^[A-Za-z][A-Za-z0-9_]{0,23}$" }
+                }
+              }
+            },
+            {
+              "if" => {
+                "required" => ["disallow_ads_personalization"],
+                "properties" => { "disallow_ads_personalization" => { "const" => true } }
+              },
+              "then" => { "properties" => { "scope" => { "const" => "user" } } }
+            }
+          ]
         },
         "customMetric" => {
           "type" => "object", "additionalProperties" => false,
           "required" => %w[parameter_name display_name scope],
           "properties" => {
             "parameter_name" => { "type" => "string", "pattern" => "^[A-Za-z][A-Za-z0-9_]{0,39}$" },
-            "display_name" => { "type" => "string", "minLength" => 1, "maxLength" => 82 },
-            "description" => { "type" => "string", "maxLength" => 150 },
+            "display_name" => {
+              "type" => "string", "pattern" => "^[A-Za-z][A-Za-z0-9_ ]{0,81}$"
+            },
+            "description" => {
+              "type" => "string", "maxLength" => 150, "pattern" => "^[^\\u0000-\\u001F\\u007F]*$"
+            },
             "scope" => { "const" => "event" },
-            "measurement_unit" => { "enum" => Configuration::Validator::METRIC_UNITS }
-          }
+            "measurement_unit" => { "enum" => Configuration::Validator::METRIC_UNITS },
+            "restricted_metric_types" => {
+              "type" => "array", "uniqueItems" => true,
+              "items" => { "enum" => Configuration::Validator::RESTRICTED_METRIC_TYPES }
+            }
+          },
+          "allOf" => [
+            {
+              "if" => {
+                "required" => ["measurement_unit"],
+                "properties" => { "measurement_unit" => { "const" => "currency" } }
+              },
+              "then" => {
+                "required" => ["restricted_metric_types"],
+                "properties" => { "restricted_metric_types" => { "minItems" => 1 } }
+              },
+              "else" => { "properties" => { "restricted_metric_types" => { "maxItems" => 0 } } }
+            }
+          ]
         }
       }
     )

data/lib/analytics_ops/configuration/validator.rb

@@ -16,10 +16,14 @@ module AnalyticsOps
       RETENTION_KEYS = %w[event_data user_data reset_on_new_activity].freeze
       GOOGLE_SIGNALS_KEYS = %w[state experimental].freeze
       DIMENSION_KEYS = %w[parameter_name display_name description scope disallow_ads_personalization].freeze
-      METRIC_KEYS = %w[parameter_name display_name description scope measurement_unit].freeze
+      METRIC_KEYS = %w[
+        parameter_name display_name description scope measurement_unit restricted_metric_types
+      ].freeze
       RETENTION_VALUES = %w[2_months 14_months 26_months 38_months 50_months].freeze
+      USER_RETENTION_VALUES = %w[2_months 14_months].freeze
       DIMENSION_SCOPES = %w[event user item].freeze
       METRIC_UNITS = %w[standard currency feet meters kilometers miles milliseconds seconds minutes hours].freeze
+      RESTRICTED_METRIC_TYPES = %w[cost_data revenue_data].freeze
       SECRET_KEY = /
         (?:\A|_)
         (?:
@@ -29,6 +33,7 @@ module AnalyticsOps
         (?:\z|_)
       /ix
       NAME = /\A[a-z][a-z0-9_]*\z/i
+      DISPLAY_NAME = /\A[A-Za-z][A-Za-z0-9_ ]{0,81}\z/
       EVENT_NAME = /\A[a-z][a-z0-9_]{0,39}\z/i
       ID = /\A\d{1,50}\z/
 
@@ -114,7 +119,7 @@ module AnalyticsOps
         retention = hash!(raw, path)
         exact_keys!(retention, RETENTION_KEYS, path)
         event_data = enum!(required(retention, "event_data", path), RETENTION_VALUES, "#{path}.event_data")
-        user_data = enum!(required(retention, "user_data", path), RETENTION_VALUES, "#{path}.user_data")
+        user_data = enum!(required(retention, "user_data", path), USER_RETENTION_VALUES, "#{path}.user_data")
         reset = boolean!(required(retention, "reset_on_new_activity", path), "#{path}.reset_on_new_activity")
 
         { "event_data" => event_data, "user_data" => user_data, "reset_on_new_activity" => reset }
@@ -181,19 +186,41 @@ module AnalyticsOps
           exact_keys!(metric, METRIC_KEYS, item_path)
           scope = enum!(required(metric, "scope", item_path), ["event"], "#{item_path}.scope")
 
+          measurement_unit = enum!(metric.fetch("measurement_unit", "standard"), METRIC_UNITS,
+                                   "#{item_path}.measurement_unit")
+          restricted_types = validate_restricted_metric_types(
+            metric.fetch("restricted_metric_types", []), measurement_unit, item_path
+          )
+
           {
             "parameter_name" => parameter_name!(required(metric, "parameter_name", item_path), scope, item_path),
             "display_name" => display_name!(required(metric, "display_name", item_path), item_path),
             "description" => description!(metric.fetch("description", ""), item_path),
             "scope" => scope,
-            "measurement_unit" => enum!(metric.fetch("measurement_unit", "standard"), METRIC_UNITS,
-                                        "#{item_path}.measurement_unit")
+            "measurement_unit" => measurement_unit,
+            "restricted_metric_types" => restricted_types
           }
         end
 
         ensure_unique!(values, ["parameter_name"], path)
       end
 
+      def validate_restricted_metric_types(raw, measurement_unit, item_path)
+        path = "#{item_path}.restricted_metric_types"
+        values = array!(raw, path).map.with_index do |value, index|
+          enum!(value, RESTRICTED_METRIC_TYPES, "#{path}[#{index}]")
+        end
+        values = ensure_unique_strings!(values, path)
+        if measurement_unit == "currency" && values.empty?
+          raise ConfigurationError, "#{path} requires cost_data or revenue_data for a currency metric"
+        end
+        if measurement_unit != "currency" && !values.empty?
+          raise ConfigurationError, "#{path} is valid only for a currency metric"
+        end
+
+        values
+      end
+
       def validate_manual_requirements(raw, profile_path)
         path = "#{profile_path}.manual_requirements"
         values = array!(raw, path).map.with_index do |value, index|
@@ -218,8 +245,9 @@ module AnalyticsOps
 
       def display_name!(value, path)
         name = string!(value, "#{path}.display_name")
-        if name.empty? || name.length > 82 || name.match?(/[\u0000-\u001f]/)
-          raise ConfigurationError, "#{path}.display_name must contain 1 to 82 printable characters"
+        unless DISPLAY_NAME.match?(name)
+          raise ConfigurationError,
+                "#{path}.display_name must start with a letter and use only letters, numbers, spaces, or underscores"
         end
 
         name
@@ -239,7 +267,8 @@ module AnalyticsOps
 
         string = string!(value, path)
         uri = URI.parse(string)
-        unless %w[http https].include?(uri.scheme) && uri.host && !uri.userinfo
+        unless string.length <= 2_048 && !string.match?(/[\u0000-\u001f\u007f]/) &&
+               %w[http https].include?(uri.scheme) && uri.host && !uri.userinfo
           raise ConfigurationError, "#{path} must be an absolute HTTP or HTTPS URI without credentials"
         end
 
@@ -308,7 +337,13 @@ module AnalyticsOps
       end
 
       def string!(value, path)
-        return value if value.is_a?(String)
+        if value.is_a?(String)
+          if Redaction.credential_shaped?(value)
+            raise ConfigurationError, "Credential-shaped value at #{path} is forbidden"
+          end
+
+          return value
+        end
 
         raise ConfigurationError, "#{path} must be a string"
       end