auth-sanitizer 0.1.4 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (25) hide show
  1. checksums.yaml +4 -4
  2. checksums.yaml.gz.sig +0 -0
  3. data/CHANGELOG.md +47 -1
  4. data/CITATION.cff +1 -1
  5. data/CODE_OF_CONDUCT.md +0 -5
  6. data/CONTRIBUTING.md +74 -29
  7. data/FUNDING.md +0 -0
  8. data/LICENSE.md +10 -0
  9. data/README.md +123 -123
  10. data/RUBOCOP.md +0 -0
  11. data/SECURITY.md +1 -4
  12. data/certs/pboling.pem +27 -0
  13. data/lib/auth/sanitizer/core.rb +0 -0
  14. data/lib/auth/sanitizer/filtered_attributes.rb +27 -9
  15. data/lib/auth/sanitizer/sanitized_logger.rb +3 -3
  16. data/lib/auth/sanitizer/thing_filter.rb +0 -0
  17. data/lib/auth/sanitizer/version.rb +1 -1
  18. data/lib/auth/sanitizer.rb +6 -0
  19. data/lib/auth_sanitizer/loader.rb +27 -1
  20. data/sig/auth/sanitizer/version.rbs +8 -0
  21. data/sig/auth/sanitizer.rbs +0 -0
  22. data.tar.gz.sig +0 -0
  23. metadata +47 -19
  24. metadata.gz.sig +0 -0
  25. data/REEK +0 -0
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 134e152d645296157cf025d9f20f4b025c2d08c93e73309112d6a7e7a9f785c3
4
- data.tar.gz: 379cd508b6292e2c1185a5ac698f6f0d641c5f3bd5a9ea7163021cb07afa4544
3
+ metadata.gz: ee9c13c8e833242ae444802320b2a44204222f09529c8d7d588bbb7f725e2dff
4
+ data.tar.gz: 7fc39449d814609f58f5c7b6ce432bbb14fb532e5cf84e0a3f296e7e2e770763
5
5
  SHA512:
6
- metadata.gz: d2e89fd515ca049f65513c2ebc298734059633723277ae406d00d930323aa4b16ed4107e18e89e794e8baf2068724abc9ca0397b986f1724c700308165d7bea1
7
- data.tar.gz: d744e2ee6178191389e5ed202e9013114bd939de28c73323cad589afb6175a4b38045356b911523d54865c262a3c8a3beb05d91fc7e9b96fb44de477a7bc62f1
6
+ metadata.gz: 1c3fdbb99b0835a7694818b891daebe08bdc6e1cd95348e214970bf02c3ece6caa41fc9ae9d22a118720c9064baf16c066c0a7718121362b7d7141622ec2ccd9
7
+ data.tar.gz: 9057c5111136395c5418bfbd2acde6206d42a7c4b19d67e7fff8ae5449675019608557d4582ac53bd62f9b1792cdf56a186ffaac10989b5148a180e2cc48efcd
checksums.yaml.gz.sig CHANGED
Binary file
data/CHANGELOG.md CHANGED
@@ -30,6 +30,48 @@ Please file a bug if you notice a violation of semantic versioning.
30
30
 
31
31
  ### Security
32
32
 
33
+ ## [0.2.0] - 2026-06-04
34
+
35
+ - TAG: [v0.2.0][0.2.0t]
36
+ - COVERAGE: 100.00% -- 145/145 lines in 6 files
37
+ - BRANCH COVERAGE: 100.00% -- 28/28 branches in 6 files
38
+ - 84.62% documented
39
+
40
+ ### Changed
41
+
42
+ - Changed `FilteredAttributes#inspect` to redact narrow patterns from
43
+ `super.inspect` instead of rebuilding object inspect output, preserving host
44
+ inspect behavior.
45
+
46
+ ### Fixed
47
+
48
+ - Redacted configured attributes inside standard Ruby hash inspect fragments,
49
+ including nested attribute hashes.
50
+
51
+ ## [0.1.5] - 2026-06-03
52
+
53
+ - TAG: [v0.1.5][0.1.5t]
54
+ - COVERAGE: 100.00% -- 138/138 lines in 6 files
55
+ - BRANCH COVERAGE: 100.00% -- 28/28 branches in 6 files
56
+ - 84.62% documented
57
+
58
+ ### Added
59
+
60
+ - Added `VersionGem::Basic` helpers to `Auth::Sanitizer::Version`.
61
+
62
+ ### Changed
63
+
64
+ - Refreshed generated package metadata, support documentation, CI workflows,
65
+ and development dependency floors from the current kettle-jem template.
66
+ - Documented that CI workflows and appraisals now target MRI Ruby 2.4+ while
67
+ runtime compatibility remains MRI Ruby 2.2+.
68
+
69
+ ### Fixed
70
+
71
+ - Prevented isolated loader namespace leakage on Ruby 2.5 and older TruffleRuby runtimes.
72
+ - Protected the custom gemspec version loader from templating rewrites so
73
+ version detection does not define top-level `Auth` on older Rubies.
74
+
33
75
  ## [0.1.4] - 2026-05-21
34
76
 
35
77
  - TAG: [v0.1.4][0.1.4t]
@@ -95,7 +137,11 @@ Please file a bug if you notice a violation of semantic versioning.
95
137
 
96
138
  - Initial release
97
139
 
98
- [Unreleased]: https://github.com//ruby-oauth/auth-sanitizer/compare/v0.1.4...HEAD
140
+ [Unreleased]: https://github.com/ruby-oauth/auth-sanitizer/compare/v0.2.0...HEAD
141
+ [0.2.0]: https://github.com/ruby-oauth/auth-sanitizer/compare/v0.1.5...v0.2.0
142
+ [0.2.0t]: https://github.com/ruby-oauth/auth-sanitizer/releases/tag/v0.2.0
143
+ [0.1.5]: https://github.com/ruby-oauth/auth-sanitizer/compare/v0.1.4...v0.1.5
144
+ [0.1.5t]: https://github.com/ruby-oauth/auth-sanitizer/releases/tag/v0.1.5
99
145
  [0.1.4]: https://github.com//ruby-oauth/auth-sanitizer/compare/v0.1.3...v0.1.4
100
146
  [0.1.4t]: https://github.com//ruby-oauth/auth-sanitizer/releases/tag/v0.1.4
101
147
  [0.1.3]: https://github.com//ruby-oauth/auth-sanitizer/compare/v0.1.2...v0.1.3
data/CITATION.cff CHANGED
@@ -7,7 +7,7 @@ type: software
7
7
  authors:
8
8
  - given-names: "Peter H."
9
9
  family-names: "Boling"
10
- email: "floss@glatzo.com"
10
+ email: "floss@galtzo.com"
11
11
  affiliation: "galtzo.com"
12
12
  orcid: 'https://orcid.org/0009-0008-8519-441X'
13
13
  identifiers:
data/CODE_OF_CONDUCT.md CHANGED
@@ -71,11 +71,6 @@ reporter of any incident.
71
71
  Community leaders will follow these Community Impact Guidelines in determining
72
72
  the consequences for any action they deem in violation of this Code of Conduct:
73
73
 
74
- * Participants will be tolerant of opposing views.
75
- * Participants must ensure that their language and actions are free of personal attacks and disparaging personal remarks.
76
- * When interpreting the words and actions of others, participants should always assume good intentions.
77
- * Behaviour which can be reasonably considered harassment will not be tolerated.
78
-
79
74
  ### 1. Correction
80
75
 
81
76
  **Community Impact**: Use of inappropriate language or other behavior deemed
data/CONTRIBUTING.md CHANGED
@@ -8,19 +8,27 @@ To submit a patch, please fork the project, create a patch with tests, and send
8
8
 
9
9
  Remember to [![Keep A Changelog][📗keep-changelog-img]][📗keep-changelog] if you make changes.
10
10
 
11
+ ## Developer Certificate of Origin
12
+
13
+ In order to protect users of this project, we require all contributors to comply with the
14
+ [Developer Certificate of Origin](https://developercertificate.org/).
15
+ This ensures that all contributions are properly licensed and attributed.
16
+
11
17
  ## Help out!
12
18
 
13
- Take a look at the `reek` list which is the file called `REEK` and find something to improve.
19
+ Take a look at the open issues and pull requests, or use the gem and find something to improve.
14
20
 
15
21
  Follow these instructions:
16
22
 
17
- 1. Fork the repository
18
- 2. Create a feature branch (`git checkout -b my-new-feature`)
19
- 3. Make some fixes.
20
- 4. Commit changes (`git commit -am 'Added some feature'`)
21
- 5. Push to the branch (`git push origin my-new-feature`)
22
- 6. Make sure to add tests for it. This is important, so it doesn't break in a future release.
23
- 7. Create new Pull Request.
23
+ 1. Join the Discord: [![Live Chat on Discord][✉️discord-invite-img]][✉️discord-invite]
24
+ 2. Fork the repository
25
+ 3. Create your feature branch (`git checkout -b my-new-feature`)
26
+ 4. Make some fixes.
27
+ 5. Commit your changes (`git commit -am 'Added some feature'`)
28
+ 6. Push to the branch (`git push origin my-new-feature`)
29
+ 7. Make sure to add tests for it. This is important, so it doesn't break in a future release.
30
+ 8. Create new Pull Request.
31
+ 9. Announce it in the channel for this org in the [Discord][✉️discord-invite]!
24
32
 
25
33
  ## Executables vs Rake tasks
26
34
 
@@ -42,6 +50,22 @@ There are many Rake tasks available as well. You can see them by running:
42
50
  bin/rake -T
43
51
  ```
44
52
 
53
+ ## Code quality checks
54
+
55
+ Run the Reek task when you want a smell check that fails on current findings:
56
+
57
+ ```shell
58
+ bin/rake reek
59
+ ```
60
+
61
+ Refresh the checked-in `REEK` backlog through the rake task, not by redirecting
62
+ the raw `reek` executable output. The rake task uses the project bundle and
63
+ avoids stale generated binstubs shadowing the Reek gem executable:
64
+
65
+ ```shell
66
+ bin/rake reek:update
67
+ ```
68
+
45
69
  ## Environment Variables for Local Development
46
70
 
47
71
  Below are the primary environment variables recognized by stone_checksums (and its integrated tools). Unless otherwise noted, set boolean values to the string "true" to enable.
@@ -78,11 +102,32 @@ Git hooks and commit message helpers (exe/kettle-commit-msg)
78
102
  - GIT_HOOK_FOOTER_SENTINEL: Required when footer append is enabled — a unique first-line sentinel to prevent duplicates
79
103
  - GIT_HOOK_FOOTER_APPEND_DEBUG: Extra debug output in the footer template (true/false)
80
104
 
105
+ Git diff driver setup
106
+ - Local setup writes repository `.gitattributes` entries and local Git `diff.smorg-*` command config so this checkout uses StructuredMerge semantic diffs.
107
+ - Global setup registers `diff.smorg-*` commands once in the user Git config; use it when you work across several StructuredMerge-enabled repositories.
108
+ - Include-file setup writes `.git/smorg/config` and includes it from local Git config, keeping command registrations out of the repository files.
109
+ - Git hosting forges generally ignore external diff drivers, so pull request views may still show raw textual diffs even when local `git diff` uses semantic drivers.
110
+
111
+ ```console
112
+ K_JEM_TEMPLATING=true bundle exec kettle-jem install
113
+ ```
114
+
115
+ Troubleshooting Git diffs
116
+ - Use `git diff --no-ext-diff` to compare against Git's built-in diff output.
117
+ - Use `git diff --no-textconv` when a textconv projection obscures the raw file bytes you need to inspect.
118
+ - If Git reports a missing `smorg-*` executable, rerun `bundle install` and the setup command above, then check `git config --local --get-regexp '^diff\.smorg-'`.
119
+ - To remove managed local entries, run `K_JEM_TEMPLATING=true bundle exec kettle-jem install --undo`; remove global command registrations with `git config --global --unset-all diff.smorg-ruby.command`.
120
+
81
121
  For a quick starting point, this repository’s `mise.toml` defines the shared defaults, and `.env.local` can override them locally. Copy `.env.local.example` to `.env.local`, use `KEY=value` lines, and either activate `mise` in your shell or run commands through `mise exec -C /path/to/project -- ...`.
82
122
 
83
123
  ## Appraisals
84
124
 
85
125
  From time to time the [appraisal2][🚎appraisal2] gemfiles in `gemfiles/` will need to be updated.
126
+ Generated appraisal and CI workflow floors are controlled by `ruby.test_minimum`
127
+ in `.structuredmerge/kettle-jem.yml`; this project was templated with `ruby.test_minimum: 2.4`.
128
+ That value describes the lowest Ruby version expected to run the test/development
129
+ toolchain, and it may be higher than the gemspec runtime floor.
130
+
86
131
  They are created and updated with the commands:
87
132
 
88
133
  ```console
@@ -97,22 +142,20 @@ bin/rake appraisal:reset
97
142
 
98
143
  When adding an appraisal to CI, check the [runner tool cache][🏃‍♂️runner-tool-cache] to see which runner to use.
99
144
 
100
- ## The Reek List
101
-
102
- Take a look at the `reek` list which is the file called `REEK` and find something to improve.
145
+ ## Run Tests
103
146
 
104
- To refresh the `reek` list:
147
+ Run tests via `kettle-test` (provided by `kettle-test`). It runs RSpec, writes the full log to
148
+ `tmp/kettle-test/rspec-TIMESTAMP.log`, and prints a compact highlight block with timing, seed,
149
+ pass/fail count, failing example list, and SimpleCov coverage percentages.
105
150
 
106
151
  ```console
107
- bundle exec reek > REEK
152
+ bundle exec kettle-test
108
153
  ```
109
154
 
110
- ## Run Tests
111
-
112
- To run all tests
155
+ For targeted runs, disable the hard coverage threshold to avoid false failures:
113
156
 
114
157
  ```console
115
- bundle exec rake test
158
+ K_SOUP_COV_MIN_HARD=false bundle exec kettle-test spec/path/to/spec.rb
116
159
  ```
117
160
 
118
161
  ### Spec organization (required)
@@ -183,33 +226,34 @@ NOTE: To build without signing the gem set `SKIP_GEM_SIGNING` to any value in th
183
226
  1. Run `bin/setup && bin/rake` as a "test, coverage, & linting" sanity check
184
227
  2. Update the version number in `version.rb`, and ensure `CHANGELOG.md` reflects changes
185
228
  3. Run `bin/setup && bin/rake` again as a secondary check, and to update `Gemfile.lock`
186
- 4. Run `git commit -am "🔖 Prepare release v<VERSION>"` to commit the changes
187
- 5. Run `git push` to trigger the final CI pipeline before release, and merge PRs
229
+ 4. Run `bin/rake yard` to regenerate the docs site using the canonical docs task
230
+ 5. Run `git commit -am "🔖 Prepare release v<VERSION>"` to commit the changes
231
+ 6. Run `git push` to trigger the final CI pipeline before release, and merge PRs
188
232
  - NOTE: Remember to [check the build][🧪build].
189
- 6. Run `export GIT_TRUNK_BRANCH_NAME="$(git remote show origin | grep 'HEAD branch' | cut -d ' ' -f5)" && echo $GIT_TRUNK_BRANCH_NAME`
190
- 7. Run `git checkout $GIT_TRUNK_BRANCH_NAME`
191
- 8. Run `git pull origin $GIT_TRUNK_BRANCH_NAME` to ensure latest trunk code
192
- 9. Optional for older Bundler (< 2.7.0): Set `SOURCE_DATE_EPOCH` so `rake build` and `rake release` use the same timestamp and generate the same checksums
233
+ 7. Run `export GIT_TRUNK_BRANCH_NAME="$(git remote show origin | grep 'HEAD branch' | cut -d ' ' -f5)" && echo $GIT_TRUNK_BRANCH_NAME`
234
+ 8. Run `git checkout $GIT_TRUNK_BRANCH_NAME`
235
+ 9. Run `git pull origin $GIT_TRUNK_BRANCH_NAME` to ensure latest trunk code
236
+ 10. Optional for older Bundler (< 2.7.0): Set `SOURCE_DATE_EPOCH` so `rake build` and `rake release` use the same timestamp and generate the same checksums
193
237
  - If your Bundler is >= 2.7.0, you can skip this; builds are reproducible by default.
194
238
  - Run `export SOURCE_DATE_EPOCH=$EPOCHSECONDS && echo $SOURCE_DATE_EPOCH`
195
239
  - If the echo above has no output, then it didn't work.
196
240
  - Note: `zsh/datetime` module is needed, if running `zsh`.
197
241
  - In older versions of `bash` you can use `date +%s` instead, i.e. `export SOURCE_DATE_EPOCH=$(date +%s) && echo $SOURCE_DATE_EPOCH`
198
- 10. Run `bundle exec rake build`
199
- 11. Run `bin/gem_checksums` (more context [1][🔒️rubygems-checksums-pr], [2][🔒️rubygems-guides-pr])
242
+ 11. Run `bundle exec rake build`
243
+ 12. Run `bin/gem_checksums` (more context [1][🔒️rubygems-checksums-pr], [2][🔒️rubygems-guides-pr])
200
244
  to create SHA-256 and SHA-512 checksums. This functionality is provided by the `stone_checksums`
201
245
  [gem][💎stone_checksums].
202
246
  - The script automatically commits but does not push the checksums
203
- 12. Sanity check the SHA256, comparing with the output from the `bin/gem_checksums` command:
247
+ 13. Sanity check the SHA256, comparing with the output from the `bin/gem_checksums` command:
204
248
  - `sha256sum pkg/<gem name>-<version>.gem`
205
- 13. Run `bundle exec rake release` which will create a git tag for the version,
249
+ 14. Run `bundle exec rake release` which will create a git tag for the version,
206
250
  push git commits and tags, and push the `.gem` file to the gem host configured in the gemspec.
207
251
 
208
- [📜src-gl]: https://gitlab.com/ruby-oauth/auth-sanitizer/
252
+ [📜src-gl]: https://gitlab.com/ruby-oauth/auth-sanitizer
209
253
  [📜src-cb]: https://codeberg.org/ruby-oauth/auth-sanitizer
210
254
  [📜src-gh]: https://github.com/ruby-oauth/auth-sanitizer
211
255
  [🧪build]: https://github.com/ruby-oauth/auth-sanitizer/actions
212
- [🤝conduct]: https://gitlab.com/ruby-oauth/auth-sanitizer/-/blob/main/CODE_OF_CONDUCT.md
256
+ [🤝conduct]: https://github.com/ruby-oauth/auth-sanitizer/blob/main/CODE_OF_CONDUCT.md
213
257
  [🖐contrib-rocks]: https://contrib.rocks
214
258
  [🖐contributors]: https://github.com/ruby-oauth/auth-sanitizer/graphs/contributors
215
259
  [🚎contributors-gl]: https://gitlab.com/ruby-oauth/auth-sanitizer/-/graphs/main
@@ -225,3 +269,4 @@ NOTE: To build without signing the gem set `SKIP_GEM_SIGNING` to any value in th
225
269
  [📌major-versions-not-sacred]: https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html
226
270
  [🚎appraisal2]: https://github.com/appraisal-rb/appraisal2
227
271
  [🏃‍♂️runner-tool-cache]: https://github.com/ruby/ruby-builder/releases/tag/toolcache
272
+ [✉️discord-invite]: https://discord.gg/3qme4XHNKN
data/FUNDING.md CHANGED
File without changes
data/LICENSE.md ADDED
@@ -0,0 +1,10 @@
1
+ # License
2
+
3
+ This project is made available under the following license.
4
+ Choose the option that best fits your use case:
5
+
6
+ - [MIT](MIT.md)
7
+
8
+ ## Copyright Notice
9
+
10
+ Copyright (c) 2026 Peter H. Boling
data/README.md CHANGED
@@ -1,17 +1,10 @@
1
- [![Galtzo FLOSS Logo by Aboling0, CC BY-SA 4.0][🖼️galtzo-i]][🖼️galtzo-discord] [![ruby-lang Logo, Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5][🖼️ruby-lang-i]][🖼️ruby-lang] [![oauth2 Logo by Chris Messina, CC BY-SA 3.0][🖼️oauth2-i]][🖼️oauth2]
1
+ <a href="https://github.com/ruby-oauth"><img alt="ruby-oauth Logo by Aboling0, CC BY-SA 4.0" src="https://logos.galtzo.com/assets/images/ruby-oauth/avatar-128px.svg" width="14%" align="right"/></a>
2
2
 
3
- [🖼️galtzo-i]: https://logos.galtzo.com/assets/images/galtzo-floss/avatar-192px.svg
4
- [🖼️galtzo-discord]: https://discord.gg/3qme4XHNKN
5
- [🖼️ruby-lang-i]: https://logos.galtzo.com/assets/images/ruby-lang/avatar-192px.svg
6
- [🖼️ruby-lang]: https://www.ruby-lang.org/
7
- [🖼️oauth2-i]: https://logos.galtzo.com/assets/images/oauth/oauth2/avatar-192px.svg
8
- [🖼️oauth2]: https://github.com/ruby-oauth/oauth2
3
+ # 💎 Auth::Sanitizer
9
4
 
10
- # 🟥 Auth::Sanitizer
5
+ [![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov] [![QLTY Maintainability][🏀qlty-mnti]][🏀qlty-mnt] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]
11
6
 
12
- [![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license-ref] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov] [![QLTY Maintainability][🏀qlty-mnti]][🏀qlty-mnt] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]
13
-
14
- `if ci_badges.map(&:color).detect { it != "green"}` ☝️ [let me know][🖼️galtzo-discord], as I may have missed the [discord notification][🖼️galtzo-discord].
7
+ `if ci_badges.map(&:color).detect { it != "green"}` ☝️ [let me know][✉️discord-invite], as I may have missed the [discord notification][✉️discord-invite].
15
8
 
16
9
  ---
17
10
 
@@ -20,13 +13,13 @@
20
13
  [![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate at ko-fi.com][🖇kofi-img]][🖇kofi]
21
14
 
22
15
  <details>
23
- <summary>👣 How will this project approach the September 2025 hostile takeover of RubyGems? 🚑️</summary>
16
+ <summary>👣 How will this project approach the September 2025 hostile takeover of RubyGems? 🚑️</summary>
24
17
 
25
18
  I've summarized my thoughts in [this blog post](https://dev.to/galtzo/hostile-takeover-of-rubygems-my-thoughts-5hlo).
26
19
 
27
20
  </details>
28
21
 
29
- ## 🌻 Synopsis
22
+ ## 🌻 Synopsis <a href="https://discord.gg/3qme4XHNKN"><img alt="Galtzo FLOSS Logo by Aboling0, CC BY-SA 4.0" src="https://logos.galtzo.com/assets/images/galtzo-floss/avatar-128px.svg" width="8%" align="right"/></a> <a href="https://ruby-toolbox.com"><img alt="ruby-lang Logo, Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5" src="https://logos.galtzo.com/assets/images/ruby-lang/avatar-128px.svg" width="8%" align="right"/></a>
30
23
 
31
24
  `auth-sanitizer` provides small, dependency-light helpers for keeping OAuth and authentication secrets out of object
32
25
  inspection and log output.
@@ -34,7 +27,7 @@ inspection and log output.
34
27
  The gem is intentionally narrow in scope. It does not change HTTP requests, token objects, persistence, or application
35
28
  configuration for you. Instead, it gives host gems and applications two reusable redaction surfaces:
36
29
 
37
- - `Auth::Sanitizer::FilteredAttributes` redacts selected instance variables from `#inspect`.
30
+ - `Auth::Sanitizer::FilteredAttributes` redacts selected attributes from standard Ruby `#inspect` output.
38
31
  - `Auth::Sanitizer::SanitizedLogger` wraps an existing logger and redacts sensitive values from string log messages.
39
32
 
40
33
  Out of the box, logger sanitization filters the key names most commonly found in OAuth and OpenID Connect debug output:
@@ -79,40 +72,44 @@ This gem is used by the following libraries to ensure clean output:
79
72
 
80
73
  ## 💡 Info you can shake a stick at
81
74
 
82
- | Tokens to Remember | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace] |
75
+ | Tokens to Remember | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace] |
83
76
  |-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
84
- | Works with JRuby | [![JRuby 9.3 Compat][💎jruby-9.3i]][🚎jruby-9.3-wf] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎jruby-9.4-wf] [![JRuby current Compat][💎jruby-c-i]][🚎10-j-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf]|
77
+ | Works with JRuby | [![JRuby 9.2 Compat][💎jruby-9.2i]][🚎jruby-9.2-wf] [![JRuby 9.3 Compat][💎jruby-9.3i]][🚎jruby-9.3-wf] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎jruby-9.4-wf] [![JRuby current Compat][💎jruby-c-i]][🚎10-j-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf]|
85
78
  | Works with Truffle Ruby | [![Truffle Ruby 22.3 Compat][💎truby-22.3i]][🚎truby-22.3-wf] [![Truffle Ruby 23.0 Compat][💎truby-23.0i]][🚎truby-23.0-wf] [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎truby-23.1-wf] <br/> [![Truffle Ruby 24.2 Compat][💎truby-24.2i]][🚎truby-24.2-wf] [![Truffle Ruby 25.0 Compat][💎truby-25.0i]][🚎truby-25.0-wf] [![Truffle Ruby current Compat][💎truby-c-i]][🚎9-t-wf]|
86
- | Works with MRI Ruby 4 | [![Ruby 4.0 Compat][💎ruby-4.0i]][🚎11-c-wf] [![Ruby current Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf]|
87
- | Works with MRI Ruby 3 | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎ruby-3.0-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎ruby-3.1-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎ruby-3.2-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎ruby-3.3-wf] [![Ruby 3.4 Compat][💎ruby-3.4i]][🚎ruby-3.4-wf]|
88
- | Works with MRI Ruby 2 | ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎ruby-2.3-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎ruby-2.4-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎ruby-2.5-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎ruby-2.6-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎ruby-2.7-wf]|
89
- | Support & Community | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork] [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor] |
90
- | Source | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc] |
91
- | Documentation | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitLab Wiki][📜gl-wiki-img]][📜gl-wiki] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki] |
92
- | Compliance | [![License: MIT][📄license-img]][📄license-ref] [![Compatible with Apache Software Projects: Verified by SkyWalking Eyes][📄license-compat-img]][📄license-compat] [![📄ilo-declaration-img]][📄ilo-declaration] [![Security Policy][🔐security-img]][🔐security] [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
93
- | Style | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2] |
94
- | Maintainer 🎖️ | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼‍♂️devto-img]][💖💁🏼‍♂️devto] |
95
- | `...` 💖 | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼‍♂️aboutme-img]][💖💁🏼‍♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub] [🛖][💖🛖hut] [🧪][💖🧪lab] |
79
+ | Works with MRI Ruby 4 | [![Ruby 4.0 Compat][💎ruby-4.0i]][🚎11-c-wf] [![Ruby current Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf]|
80
+ | Works with MRI Ruby 3 | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎ruby-3.0-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎ruby-3.1-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎ruby-3.2-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎ruby-3.3-wf] [![Ruby 3.4 Compat][💎ruby-3.4i]][🚎ruby-3.4-wf]|
81
+ | Works with MRI Ruby 2 | ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎ruby-2.4-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎ruby-2.5-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎ruby-2.6-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎ruby-2.7-wf]|
82
+ | Support & Community | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork] [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor] |
83
+ | Source | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc] |
84
+ | Documentation | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitLab Wiki][📜gl-wiki-img]][📜gl-wiki] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki] |
85
+ | Compliance | [![License: MIT][📄license-img]][📄license] [![Apache license compatibility: Category A][📄license-compat-img]][📄license-compat] [![📄ilo-declaration-img]][📄ilo-declaration] [![Security Policy][🔐security-img]][🔐security] [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
86
+ | Style | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2] |
87
+ | Maintainer 🎖️ | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼‍♂️devto-img]][💖💁🏼‍♂️devto] |
88
+ | `...` 💖 | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼‍♂️aboutme-img]][💖💁🏼‍♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub] [🛖][💖🛖hut] [🧪][💖🧪lab] |
96
89
 
97
90
  ### Compatibility
98
91
 
99
92
  Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRuby.
93
+ CI workflows and Appraisals are generated for MRI Ruby 2.4+.
94
+ This test floor is configured by `ruby.test_minimum` in `.kettle-jem.yml` and
95
+ may be higher than the gem's runtime compatibility floor when legacy Rubies are
96
+ not practical for the current toolchain.
100
97
 
101
- | 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 and the color 💚 green 💚 |
98
+ | 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 and the color 💚 green 💚 |
102
99
  |------------------------------------------------|--------------------------------------------------------|
103
- | 👟 Check it out! | ✨ [github.com/appraisal-rb/appraisal2][💎appraisal2] ✨ |
100
+ | 👟 Check it out! | ✨ [github.com/appraisal-rb/appraisal2][💎appraisal2] ✨ |
104
101
 
105
102
  ### Federated DVCS
106
103
 
107
104
  <details markdown="1">
108
- <summary>Find this repo on federated forges (Coming soon!)</summary>
105
+ <summary>Find this repo on federated forges (Coming soon!)</summary>
109
106
 
110
- | Federated [DVCS][💎d-in-dvcs] Repository | Status | Issues | PRs | Wiki | CI | Discussions |
107
+ | Federated [DVCS][💎d-in-dvcs] Repository | Status | Issues | PRs | Wiki | CI | Discussions |
111
108
  |-------------------------------------------------|-----------------------------------------------------------------------|---------------------------|--------------------------|---------------------------|--------------------------|------------------------------|
112
- | 🧪 [ruby-oauth/auth-sanitizer on GitLab][📜src-gl] | The Truth | [💚][🤝gl-issues] | [💚][🤝gl-pulls] | [💚][📜gl-wiki] | 🐭 Tiny Matrix | ➖ |
113
- | 🧊 [ruby-oauth/auth-sanitizer on CodeBerg][📜src-cb] | An Ethical Mirror ([Donate][🤝cb-donate]) | [💚][🤝cb-issues] | [💚][🤝cb-pulls] | ➖ | ⭕️ No Matrix | ➖ |
114
- | 🐙 [ruby-oauth/auth-sanitizer on GitHub][📜src-gh] | Another Mirror | [💚][🤝gh-issues] | [💚][🤝gh-pulls] | [💚][📜gh-wiki] | 💯 Full Matrix | [💚][gh-discussions] |
115
- | 🎮️ [Discord Server][✉️discord-invite] | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] | [Let's][✉️discord-invite] | [talk][✉️discord-invite] | [about][✉️discord-invite] | [this][✉️discord-invite] | [library!][✉️discord-invite] |
109
+ | 🧪 [ruby-oauth/auth-sanitizer on GitLab][📜src-gl] | The Truth | [💚][🤝gl-issues] | [💚][🤝gl-pulls] | [💚][📜gl-wiki] | 🐭 Tiny Matrix | ➖ |
110
+ | 🧊 [ruby-oauth/auth-sanitizer on CodeBerg][📜src-cb] | An Ethical Mirror ([Donate][🤝cb-donate]) | [💚][🤝cb-issues] | [💚][🤝cb-pulls] | ➖ | ⭕️ No Matrix | ➖ |
111
+ | 🐙 [ruby-oauth/auth-sanitizer on GitHub][📜src-gh] | Another Mirror | [💚][🤝gh-issues] | [💚][🤝gh-pulls] | [💚][📜gh-wiki] | 💯 Full Matrix | [💚][gh-discussions] |
112
+ | 🎮️ [Discord Server][✉️discord-invite] | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] | [Let's][✉️discord-invite] | [talk][✉️discord-invite] | [about][✉️discord-invite] | [this][✉️discord-invite] | [library!][✉️discord-invite] |
116
113
 
117
114
  </details>
118
115
 
@@ -123,7 +120,7 @@ Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRu
123
120
  Available as part of the Tidelift Subscription.
124
121
 
125
122
  <details markdown="1">
126
- <summary>Need enterprise-level guarantees?</summary>
123
+ <summary>Need enterprise-level guarantees?</summary>
127
124
 
128
125
  The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.
129
126
 
@@ -155,41 +152,6 @@ If bundler is not being used to manage dependencies, install the gem by executin
155
152
  gem install auth-sanitizer
156
153
  ```
157
154
 
158
- ### 🔒 Secure Installation
159
-
160
- <details markdown="1">
161
- <summary>For Medium or High Security Installations</summary>
162
-
163
- This gem is cryptographically signed and has verifiable [SHA-256 and SHA-512][💎SHA_checksums] checksums by
164
- [stone_checksums][💎stone_checksums]. Be sure the gem you install hasn’t been tampered with
165
- by following the instructions below.
166
-
167
- Add my public key (if you haven’t already; key expires 2045-04-29) as a trusted certificate:
168
-
169
- ```console
170
- gem cert --add <(curl -Ls https://raw.github.com/galtzo-floss/certs/main/pboling.pem)
171
- ```
172
-
173
- You only need to do that once. Then proceed to install with:
174
-
175
- ```console
176
- gem install auth-sanitizer -P HighSecurity
177
- ```
178
-
179
- The `HighSecurity` trust profile will verify signed gems, and not allow the installation of unsigned dependencies.
180
-
181
- If you want to up your security game full-time:
182
-
183
- ```console
184
- bundle config set --global trust-policy MediumSecurity
185
- ```
186
-
187
- `MediumSecurity` instead of `HighSecurity` is necessary if not all the gems you use are signed.
188
-
189
- NOTE: Be prepared to track down certs for signed gems and add them the same way you added mine.
190
-
191
- </details>
192
-
193
155
  ## ⚙️ Configuration
194
156
 
195
157
  Most applications can use the defaults. Configuration is available when a host gem or application wants to align
@@ -255,7 +217,7 @@ unless auth_sanitizer_spec && auth_sanitizer_requirement.satisfied_by?(auth_sani
255
217
  end
256
218
  auth_sanitizer_loader_path = File.join(
257
219
  auth_sanitizer_spec.full_gem_path,
258
- "lib/auth_sanitizer/loader.rb",
220
+ "lib/auth_sanitizer/loader.rb"
259
221
  )
260
222
  unless File.file?(auth_sanitizer_loader_path)
261
223
  raise LoadError, "auth-sanitizer #{auth_sanitizer_requirement} loader not found at #{auth_sanitizer_loader_path}"
@@ -287,7 +249,7 @@ unless auth_sanitizer_spec && auth_sanitizer_requirement.satisfied_by?(auth_sani
287
249
  end
288
250
  auth_sanitizer_loader_path = File.join(
289
251
  auth_sanitizer_spec.full_gem_path,
290
- "lib/auth_sanitizer/loader.rb",
252
+ "lib/auth_sanitizer/loader.rb"
291
253
  )
292
254
  unless File.file?(auth_sanitizer_loader_path)
293
255
  raise LoadError, "auth-sanitizer #{auth_sanitizer_requirement} loader not found at #{auth_sanitizer_loader_path}"
@@ -297,7 +259,7 @@ auth_sanitizer_loader_namespace = Module.new
297
259
  auth_sanitizer_loader_namespace.module_eval(
298
260
  File.read(auth_sanitizer_loader_path),
299
261
  auth_sanitizer_loader_path,
300
- 1,
262
+ 1
301
263
  )
302
264
 
303
265
  AUTH_SANITIZER = auth_sanitizer_loader_namespace
@@ -353,7 +315,7 @@ logger = Auth::Sanitizer::SanitizedLogger.new(
353
315
  api_key
354
316
  private_key
355
317
  session_secret
356
- ],
318
+ ]
357
319
  )
358
320
  ```
359
321
 
@@ -363,7 +325,7 @@ You can also replace the list entirely:
363
325
  logger = Auth::Sanitizer::SanitizedLogger.new(
364
326
  Logger.new($stdout),
365
327
  filtered_keys: %w[my_secret],
366
- label: "[GONE]",
328
+ label: "[GONE]"
367
329
  )
368
330
  ```
369
331
 
@@ -395,8 +357,43 @@ class OAuthCredential
395
357
  end
396
358
  ```
397
359
 
398
- Declared names are matched against instance variable names. For example, `filtered_attributes :access_token` redacts
399
- `@access_token` in `#inspect`.
360
+ `FilteredAttributes#inspect` delegates to `super.inspect` first, then redacts only narrow, standard Ruby inspect
361
+ fragments for configured names. This preserves host object inspect behavior instead of rebuilding the object's output.
362
+
363
+ For example, `filtered_attributes :access_token` redacts `@access_token="..."` in normal object inspect output:
364
+
365
+ ```ruby
366
+ OAuthCredential.new("secret", Time.now).inspect
367
+ # => #<OAuthCredential:0x... @access_token=[FILTERED], @expires_at=2026-06-04 08:00:00 -0600>
368
+ ```
369
+
370
+ Configured names are also redacted when they appear as string-valued keys inside standard Ruby hash inspect fragments,
371
+ which is useful for adapter models that store attributes in an internal hash:
372
+
373
+ ```ruby
374
+ class IdentityRecord
375
+ include Auth::Sanitizer::FilteredAttributes
376
+
377
+ filtered_attributes :password_digest
378
+
379
+ def initialize(identity_data)
380
+ @identity_data = identity_data
381
+ end
382
+ end
383
+
384
+ IdentityRecord.new({id: 1, password_digest: "$2a$secret"}).inspect
385
+ # => #<IdentityRecord:0x... @identity_data={id: 1, password_digest: [FILTERED]}>
386
+ ```
387
+
388
+ The inspect redactor intentionally leaves unsupported or highly customized inspect formats unchanged. It only replaces
389
+ quoted string values in these standard shapes:
390
+
391
+ - `@name="value"`
392
+ - `{name: "value"}`
393
+ - `{:name => "value"}`
394
+ - `{"name" => "value"}`
395
+
396
+ This conservative behavior avoids breaking host models whose `inspect` output has application-specific formatting.
400
397
 
401
398
  Calling `filtered_attributes` again replaces the class-level list:
402
399
 
@@ -461,15 +458,16 @@ end
461
458
  response = TokenResponse.new(
462
459
  access_token: "access-token-value",
463
460
  refresh_token: "refresh-token-value",
464
- scope: "profile email",
461
+ scope: "profile email"
465
462
  )
466
463
 
467
464
  response.inspect
468
- # => #<TokenResponse:123456 @access_token=[FILTERED], @refresh_token=[FILTERED], @scope="profile email">
465
+ # => #<TokenResponse:0x... @access_token=[FILTERED], @refresh_token=[FILTERED], @scope="profile email">
469
466
  ```
470
467
 
471
468
  Only the configured attributes are redacted. Other instance variables remain visible so inspected objects are still
472
- useful while debugging.
469
+ useful while debugging. Inspect filtering is conservative: unsupported custom formats are left unchanged rather than
470
+ risking a malformed `inspect` result.
473
471
 
474
472
  ### Redact Logger Output
475
473
 
@@ -524,7 +522,7 @@ Use `filtered_keys:` for application-specific secrets:
524
522
  logger = Auth::Sanitizer::SanitizedLogger.new(
525
523
  Logger.new($stdout),
526
524
  filtered_keys: %w[access_token api_key signing_secret],
527
- label: "[SECRET]",
525
+ label: "[SECRET]"
528
526
  )
529
527
 
530
528
  logger.debug("api_key=12345&access_token=abc123")
@@ -553,8 +551,8 @@ While ruby-oauth tools are free software and will always be, the project would b
553
551
  Raising a monthly budget of... "dollars" would make the project more sustainable.
554
552
 
555
553
  We welcome both individual and corporate sponsors! We also offer a
556
- wide array of funding channels to account for your preferences
557
- (although currently [Open Collective][🖇osc] is our preferred funding platform).
554
+ wide array of funding channels to account for your preferences.
555
+ Currently, [Open Collective][🖇osc] is our preferred funding platform.
558
556
 
559
557
  **If you're working in a company that's making significant use of ruby-oauth tools we'd
560
558
  appreciate it if you suggest to your company to become a ruby-oauth sponsor.**
@@ -566,7 +564,7 @@ You can support the development of ruby-oauth tools via
566
564
  [Open Collective][🖇osc]
567
565
  and [Tidelift][🏙️entsup-tidelift].
568
566
 
569
- | 📍 NOTE |
567
+ | 📍 NOTE |
570
568
  |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
571
569
  | If doing a sponsorship in the form of donation is problematic for your company <br/> from an accounting standpoint, we'd recommend the use of Tidelift, <br/> where you can get a support-like subscription instead. |
572
570
 
@@ -594,7 +592,7 @@ No sponsors yet. Be the first!
594
592
 
595
593
  ### Another way to support open-source
596
594
 
597
- I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small. Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions. I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
595
+ I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small. Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions. I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
598
596
 
599
597
  If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in `bundle fund`.
600
598
 
@@ -611,7 +609,7 @@ See [SECURITY.md][🔐security].
611
609
  ## 🤝 Contributing
612
610
 
613
611
  If you need some ideas of where to help, you could work on adding more code coverage,
614
- or if it is already 💯 (see [below](#code-coverage)) check [reek](REEK), [issues][🤝gh-issues], or [PRs][🤝gh-pulls],
612
+ or if it is already 💯 (see [below](#code-coverage)) check [issues][🤝gh-issues] or [PRs][🤝gh-pulls],
615
613
  or use the gem and think about how it could be better.
616
614
 
617
615
  We [![Keep A Changelog][📗keep-changelog-img]][📗keep-changelog] so if you make changes, remember to update it.
@@ -624,12 +622,17 @@ See [CONTRIBUTING.md][🤝contributing].
624
622
 
625
623
  ### Code Coverage
626
624
 
625
+ <details markdown="1">
626
+ <summary>Coverage service badges</summary>
627
+
627
628
  [![Coverage Graph][🏀codecov-g]][🏀codecov]
628
629
 
629
630
  [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls]
630
631
 
631
632
  [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov]
632
633
 
634
+ </details>
635
+
633
636
  ### 🪇 Code of Conduct
634
637
 
635
638
  Everyone interacting with this project's codebases, issue trackers,
@@ -644,13 +647,13 @@ Made with [contributors-img][🖐contrib-rocks].
644
647
  Also see GitLab Contributors: [https://gitlab.com/ruby-oauth/auth-sanitizer/-/graphs/main][🚎contributors-gl]
645
648
 
646
649
  <details>
647
- <summary>⭐️ Star History</summary>
650
+ <summary>⭐️ Star History</summary>
648
651
 
649
- <a href="https://star-history.com/#ruby-oauth/auth-sanitizer&Date">
652
+ <a href="https://star-history.com/ruby-oauth/auth-sanitizer&Date">
650
653
  <picture>
651
- <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=ruby-oauth/auth-sanitizer&type=Date&theme=dark" />
652
- <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=ruby-oauth/auth-sanitizer&type=Date" />
653
- <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=ruby-oauth/auth-sanitizer&type=Date" />
654
+ <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=ruby-oauth/auth-sanitizer&type=Date&theme=dark" />
655
+ <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=ruby-oauth/auth-sanitizer&type=Date" />
656
+ <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=ruby-oauth/auth-sanitizer&type=Date" />
654
657
  </picture>
655
658
  </a>
656
659
 
@@ -658,19 +661,8 @@ Also see GitLab Contributors: [https://gitlab.com/ruby-oauth/auth-sanitizer/-/gr
658
661
 
659
662
  ## 📌 Versioning
660
663
 
661
- This Library adheres to [![Semantic Versioning 2.0.0][📌semver-img]][📌semver].
662
- Violations of this scheme should be reported as bugs.
663
- Specifically, if a minor or patch version is released that breaks backward compatibility,
664
- a new version should be immediately released that restores compatibility.
665
- Breaking changes to the public API will only be introduced with new major versions.
666
-
667
- > dropping support for a platform is both obviously and objectively a breaking change <br/>
668
- >—Jordan Harband ([@ljharb](https://github.com/ljharb), maintainer of SemVer) [in SemVer issue 716][📌semver-breaking]
669
-
670
- I understand that policy doesn't work universally ("exceptions to every rule!"),
671
- but it is the policy here.
672
- As such, in many cases it is good to specify a dependency on this library using
673
- the [Pessimistic Version Constraint][📌pvc] with two digits of precision.
664
+ This library follows [![Semantic Versioning 2.0.0][📌semver-img]][📌semver] for its public API where practical.
665
+ For most applications, prefer the [Pessimistic Version Constraint][📌pvc] with two digits of precision.
674
666
 
675
667
  For example:
676
668
 
@@ -681,8 +673,8 @@ spec.add_dependency("auth-sanitizer", "~> 0.0")
681
673
  <details markdown="1">
682
674
  <summary>📌 Is "Platform Support" part of the public API? More details inside.</summary>
683
675
 
684
- SemVer should, IMO, but doesn't explicitly, say that dropping support for specific Platforms
685
- is a *breaking change* to an API, and for that reason the bike shedding is endless.
676
+ Dropping support for a platform can be a breaking change for affected users.
677
+ If a release changes supported platforms, it should be called out clearly in the changelog and versioned with that impact in mind.
686
678
 
687
679
  To get a better understanding of how SemVer is intended to work over a project's lifetime,
688
680
  read this article from the creator of SemVer:
@@ -702,6 +694,13 @@ the [MIT](MIT.md) [![License: MIT][📄license-img]][📄license-ref].
702
694
 
703
695
  See [LICENSE.md][📄license] for the official copyright notice.
704
696
 
697
+ <details markdown="1">
698
+ <summary>Copyright holders</summary>
699
+
700
+ - Copyright (c) 2026 Peter H. Boling
701
+
702
+ </details>
703
+
705
704
  ## 🤑 A request for help
706
705
 
707
706
  Maintainers have teeth and need to pay their dentists.
@@ -721,6 +720,8 @@ To say "thanks!" ☝️ Join the Discord or 👇️ send money.
721
720
 
722
721
  ### Please give the project a star ⭐ ♥.
723
722
 
723
+ Many parts of this project are actively managed by a [kettle-jem](https://github.com/structuredmerge/structuredmerge-ruby/tree/main/gems/kettle-jem) smart template utilizing [StructuredMerge.org](https://structuredmerge.org) merge contracts.
724
+
724
725
  Thanks for RTFM. ☺️
725
726
 
726
727
  [⛳liberapay-img]: https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&color=a51611&style=flat
@@ -765,7 +766,7 @@ Thanks for RTFM. ☺️
765
766
  [⛳️gem-name]: https://bestgems.org/gems/auth-sanitizer
766
767
  [⛳️name-img]: https://img.shields.io/badge/name-auth--sanitizer-3C2D2D.svg?style=square&logo=rubygems&logoColor=red
767
768
  [⛳️tag-img]: https://img.shields.io/github/tag/ruby-oauth/auth-sanitizer.svg
768
- [⛳️tag]: http://github.com/ruby-oauth/auth-sanitizer/releases
769
+ [⛳️tag]: https://github.com/ruby-oauth/auth-sanitizer/releases
769
770
  [🚂maint-blog]: http://www.railsbling.com/tags/auth-sanitizer
770
771
  [🚂maint-blog-img]: https://img.shields.io/badge/blog-railsbling-0093D0.svg?style=for-the-badge&logo=rubyonrails&logoColor=orange
771
772
  [🚂maint-contact]: http://www.railsbling.com/contact
@@ -800,7 +801,7 @@ Thanks for RTFM. ☺️
800
801
  [💁🏼‍♂️peterboling]: http://www.peterboling.com
801
802
  [🚂railsbling]: http://www.railsbling.com
802
803
  [📜src-gl-img]: https://img.shields.io/badge/GitLab-FBA326?style=for-the-badge&logo=Gitlab&logoColor=orange
803
- [📜src-gl]: https://gitlab.com/ruby-oauth/auth-sanitizer/
804
+ [📜src-gl]: https://gitlab.com/ruby-oauth/auth-sanitizer
804
805
  [📜src-cb-img]: https://img.shields.io/badge/CodeBerg-4893CC?style=for-the-badge&logo=CodeBerg&logoColor=blue
805
806
  [📜src-cb]: https://codeberg.org/ruby-oauth/auth-sanitizer
806
807
  [📜src-gh-img]: https://img.shields.io/badge/GitHub-238636?style=for-the-badge&logo=Github&logoColor=green
@@ -809,8 +810,8 @@ Thanks for RTFM. ☺️
809
810
  [📜docs-head-rd-img]: https://img.shields.io/badge/YARD_on_Galtzo.com-HEAD-943CD2?style=for-the-badge&logo=readthedocs&logoColor=white
810
811
  [📜gl-wiki]: https://gitlab.com/ruby-oauth/auth-sanitizer/-/wikis/home
811
812
  [📜gh-wiki]: https://github.com/ruby-oauth/auth-sanitizer/wiki
812
- [📜gl-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&logo=gitlab&logoColor=white
813
- [📜gh-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&logo=github&logoColor=white
813
+ [📜gl-wiki-img]: https://img.shields.io/badge/wiki-gitlab-943CD2.svg?style=for-the-badge&logo=gitlab&logoColor=white
814
+ [📜gh-wiki-img]: https://img.shields.io/badge/wiki-github-943CD2.svg?style=for-the-badge&logo=github&logoColor=white
814
815
  [👽dl-rank]: https://bestgems.org/gems/auth-sanitizer
815
816
  [👽dl-ranki]: https://img.shields.io/gem/rd/auth-sanitizer.svg
816
817
  [👽version]: https://bestgems.org/gems/auth-sanitizer
@@ -823,9 +824,6 @@ Thanks for RTFM. ☺️
823
824
  [🏀codecovi]: https://codecov.io/gh/ruby-oauth/auth-sanitizer/graph/badge.svg
824
825
  [🏀coveralls]: https://coveralls.io/github/ruby-oauth/auth-sanitizer?branch=main
825
826
  [🏀coveralls-img]: https://coveralls.io/repos/github/ruby-oauth/auth-sanitizer/badge.svg?branch=main
826
- [🖐codeQL]: https://github.com/ruby-oauth/auth-sanitizer/security/code-scanning
827
- [🖐codeQL-img]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/codeql-analysis.yml/badge.svg
828
- [🚎ruby-2.3-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/ruby-2.3.yml
829
827
  [🚎ruby-2.4-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/ruby-2.4.yml
830
828
  [🚎ruby-2.5-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/ruby-2.5.yml
831
829
  [🚎ruby-2.6-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/ruby-2.6.yml
@@ -835,6 +833,7 @@ Thanks for RTFM. ☺️
835
833
  [🚎ruby-3.2-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/ruby-3.2.yml
836
834
  [🚎ruby-3.3-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/ruby-3.3.yml
837
835
  [🚎ruby-3.4-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/ruby-3.4.yml
836
+ [🚎jruby-9.2-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/jruby-9.2.yml
838
837
  [🚎jruby-9.3-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/jruby-9.3.yml
839
838
  [🚎jruby-9.4-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/jruby-9.4.yml
840
839
  [🚎truby-22.3-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/truffleruby-22.3.yml
@@ -863,7 +862,6 @@ Thanks for RTFM. ☺️
863
862
  [🚎15-🪪-wf]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/license-eye.yml
864
863
  [🚎15-🪪-wfi]: https://github.com/ruby-oauth/auth-sanitizer/actions/workflows/license-eye.yml/badge.svg
865
864
  [💎ruby-2.2i]: https://img.shields.io/badge/Ruby-2.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=white
866
- [💎ruby-2.3i]: https://img.shields.io/badge/Ruby-2.3-DF00CA?style=for-the-badge&logo=ruby&logoColor=white
867
865
  [💎ruby-2.4i]: https://img.shields.io/badge/Ruby-2.4-DF00CA?style=for-the-badge&logo=ruby&logoColor=white
868
866
  [💎ruby-2.5i]: https://img.shields.io/badge/Ruby-2.5-DF00CA?style=for-the-badge&logo=ruby&logoColor=white
869
867
  [💎ruby-2.6i]: https://img.shields.io/badge/Ruby-2.6-DF00CA?style=for-the-badge&logo=ruby&logoColor=white
@@ -882,6 +880,7 @@ Thanks for RTFM. ☺️
882
880
  [💎truby-24.2i]: https://img.shields.io/badge/Truffle_Ruby-24.2-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
883
881
  [💎truby-25.0i]: https://img.shields.io/badge/Truffle_Ruby-25.0-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
884
882
  [💎truby-c-i]: https://img.shields.io/badge/Truffle_Ruby-current-34BCB1?style=for-the-badge&logo=ruby&logoColor=green
883
+ [💎jruby-9.2i]: https://img.shields.io/badge/JRuby-9.2-FBE742?style=for-the-badge&logo=ruby&logoColor=red
885
884
  [💎jruby-9.3i]: https://img.shields.io/badge/JRuby-9.3-FBE742?style=for-the-badge&logo=ruby&logoColor=red
886
885
  [💎jruby-9.4i]: https://img.shields.io/badge/JRuby-9.4-FBE742?style=for-the-badge&logo=ruby&logoColor=red
887
886
  [💎jruby-c-i]: https://img.shields.io/badge/JRuby-current-FBE742?style=for-the-badge&logo=ruby&logoColor=green
@@ -893,34 +892,35 @@ Thanks for RTFM. ☺️
893
892
  [🤝cb-issues]: https://codeberg.org/ruby-oauth/auth-sanitizer/issues
894
893
  [🤝cb-pulls]: https://codeberg.org/ruby-oauth/auth-sanitizer/pulls
895
894
  [🤝cb-donate]: https://donate.codeberg.org/
896
- [🤝contributing]: CONTRIBUTING.md
897
- [🏀codecov-g]: https://codecov.io/gh/ruby-oauth/auth-sanitizer/graphs/tree.svg
895
+ [🤝contributing]: https://github.com/ruby-oauth/auth-sanitizer/blob/main/CONTRIBUTING.md
896
+ [🏀codecov-g]: https://codecov.io/gh/ruby-oauth/auth-sanitizer/graph/badge.svg
898
897
  [🖐contrib-rocks]: https://contrib.rocks
899
898
  [🖐contributors]: https://github.com/ruby-oauth/auth-sanitizer/graphs/contributors
900
899
  [🖐contributors-img]: https://contrib.rocks/image?repo=ruby-oauth/auth-sanitizer
901
900
  [🚎contributors-gl]: https://gitlab.com/ruby-oauth/auth-sanitizer/-/graphs/main
902
- [🪇conduct]: CODE_OF_CONDUCT.md
901
+ [🪇conduct]: https://github.com/ruby-oauth/auth-sanitizer/blob/main/CODE_OF_CONDUCT.md
903
902
  [🪇conduct-img]: https://img.shields.io/badge/Contributor_Covenant-2.1-259D6C.svg
904
903
  [📌pvc]: http://guides.rubygems.org/patterns/#pessimistic-version-constraint
905
904
  [📌semver]: https://semver.org/spec/v2.0.0.html
906
905
  [📌semver-img]: https://img.shields.io/badge/semver-2.0.0-259D6C.svg?style=flat
907
906
  [📌semver-breaking]: https://github.com/semver/semver/issues/716#issuecomment-869336139
908
907
  [📌major-versions-not-sacred]: https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html
909
- [📌changelog]: CHANGELOG.md
908
+ [📌changelog]: https://github.com/ruby-oauth/auth-sanitizer/blob/main/CHANGELOG.md
910
909
  [📗keep-changelog]: https://keepachangelog.com/en/1.0.0/
911
910
  [📗keep-changelog-img]: https://img.shields.io/badge/keep--a--changelog-1.0.0-34495e.svg?style=flat
912
911
  [📌gitmoji]: https://gitmoji.dev
913
912
  [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
914
913
  [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
915
- [🧮kloc-img]: https://img.shields.io/badge/KLOC-0.135-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
916
- [🔐security]: SECURITY.md
914
+ [🧮kloc-img]: https://img.shields.io/badge/KLOC-0.145-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
915
+ [🔐security]: https://github.com/ruby-oauth/auth-sanitizer/blob/main/SECURITY.md
917
916
  [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
918
917
  [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year
919
918
  [📄license]: LICENSE.md
920
- [📄license-ref]: https://opensource.org/licenses/MIT
919
+ [📄license-ref]: MIT.md
921
920
  [📄license-img]: https://img.shields.io/badge/License-MIT-259D6C.svg
922
- [📄license-compat]: https://dev.to/galtzo/how-to-check-license-compatibility-41h0
923
- [📄license-compat-img]: https://img.shields.io/badge/Apache_Compatible:_Category_A-%E2%9C%93-259D6C.svg?style=flat&logo=Apache
921
+ [📄license-compat]: https://www.apache.org/legal/resolved.html#category-a
922
+ [📄license-compat-img]: https://img.shields.io/badge/Apache_Compatible:_Category_A-✓-259D6C.svg?style=flat&logo=Apache
923
+
924
924
  [📄ilo-declaration]: https://www.ilo.org/declaration/lang--en/index.htm
925
925
  [📄ilo-declaration-img]: https://img.shields.io/badge/ILO_Fundamental_Principles-✓-259D6C.svg?style=flat
926
926
  [🚎yard-current]: http://rubydoc.info/gems/auth-sanitizer
data/RUBOCOP.md CHANGED
File without changes
data/SECURITY.md CHANGED
@@ -4,7 +4,7 @@
4
4
 
5
5
  | Version | Supported |
6
6
  |----------|-----------|
7
- | 1.latest | ✅ |
7
+ | 0.latest | ✅ |
8
8
 
9
9
  ## Security contact information
10
10
 
@@ -12,8 +12,6 @@ To report a security vulnerability, please use the
12
12
  [Tidelift security contact](https://tidelift.com/security).
13
13
  Tidelift will coordinate the fix and disclosure.
14
14
 
15
- More detailed explanation of the process is in [IRP.md][IRP]
16
-
17
15
  ## Additional Support
18
16
 
19
17
  If you are interested in support for versions older than the latest release,
@@ -21,4 +19,3 @@ please consider sponsoring the project / maintainer @ https://liberapay.com/pbol
21
19
  or find other sponsorship links in the [README].
22
20
 
23
21
  [README]: README.md
24
- [IRP]: IRP.md
data/certs/pboling.pem ADDED
@@ -0,0 +1,27 @@
1
+ -----BEGIN CERTIFICATE-----
2
+ MIIEgDCCAuigAwIBAgIBATANBgkqhkiG9w0BAQsFADBDMRUwEwYDVQQDDAxwZXRl
3
+ ci5ib2xpbmcxFTATBgoJkiaJk/IsZAEZFgVnbWFpbDETMBEGCgmSJomT8ixkARkW
4
+ A2NvbTAeFw0yNTA1MDQxNTMzMDlaFw00NTA0MjkxNTMzMDlaMEMxFTATBgNVBAMM
5
+ DHBldGVyLmJvbGluZzEVMBMGCgmSJomT8ixkARkWBWdtYWlsMRMwEQYKCZImiZPy
6
+ LGQBGRYDY29tMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAruUoo0WA
7
+ uoNuq6puKWYeRYiZekz/nsDeK5x/0IEirzcCEvaHr3Bmz7rjo1I6On3gGKmiZs61
8
+ LRmQ3oxy77ydmkGTXBjruJB+pQEn7UfLSgQ0xa1/X3kdBZt6RmabFlBxnHkoaGY5
9
+ mZuZ5+Z7walmv6sFD9ajhzj+oIgwWfnEHkXYTR8I6VLN7MRRKGMPoZ/yvOmxb2DN
10
+ coEEHWKO9CvgYpW7asIihl/9GMpKiRkcYPm9dGQzZc6uTwom1COfW0+ZOFrDVBuV
11
+ FMQRPswZcY4Wlq0uEBLPU7hxnCL9nKK6Y9IhdDcz1mY6HZ91WImNslOSI0S8hRpj
12
+ yGOWxQIhBT3fqCBlRIqFQBudrnD9jSNpSGsFvbEijd5ns7Z9ZMehXkXDycpGAUj1
13
+ to/5cuTWWw1JqUWrKJYoifnVhtE1o1DZ+LkPtWxHtz5kjDG/zR3MG0Ula0UOavlD
14
+ qbnbcXPBnwXtTFeZ3C+yrWpE4pGnl3yGkZj9SMTlo9qnTMiPmuWKQDatAgMBAAGj
15
+ fzB9MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQWBBQE8uWvNbPVNRXZ
16
+ HlgPbc2PCzC4bjAhBgNVHREEGjAYgRZwZXRlci5ib2xpbmdAZ21haWwuY29tMCEG
17
+ A1UdEgQaMBiBFnBldGVyLmJvbGluZ0BnbWFpbC5jb20wDQYJKoZIhvcNAQELBQAD
18
+ ggGBAJbnUwfJQFPkBgH9cL7hoBfRtmWiCvdqdjeTmi04u8zVNCUox0A4gT982DE9
19
+ wmuN12LpdajxZONqbXuzZvc+nb0StFwmFYZG6iDwaf4BPywm2e/Vmq0YG45vZXGR
20
+ L8yMDSK1cQXjmA+ZBKOHKWavxP6Vp7lWvjAhz8RFwqF9GuNIdhv9NpnCAWcMZtpm
21
+ GUPyIWw/Cw/2wZp74QzZj6Npx+LdXoLTF1HMSJXZ7/pkxLCsB8m4EFVdb/IrW/0k
22
+ kNSfjtAfBHO8nLGuqQZVH9IBD1i9K6aSs7pT6TW8itXUIlkIUI2tg5YzW6OFfPzq
23
+ QekSkX3lZfY+HTSp/o+YvKkqWLUV7PQ7xh1ZYDtocpaHwgxe/j3bBqHE+CUPH2vA
24
+ 0V/FwdTRWcwsjVoOJTrYcff8pBZ8r2MvtAc54xfnnhGFzeRHfcltobgFxkAXdE6p
25
+ DVjBtqT23eugOqQ73umLcYDZkc36vnqGxUBSsXrzY9pzV5gGr2I8YUxMqf6ATrZt
26
+ L9nRqA==
27
+ -----END CERTIFICATE-----
data/lib/auth/sanitizer/core.rb CHANGED
File without changes
data/lib/auth/sanitizer/filtered_attributes.rb CHANGED
@@ -34,10 +34,10 @@ module Auth
34
34
  # the current {Auth::Sanitizer.filtered_label} value.
35
35
  module InitializerMethods
36
36
  def initialize(*args, &block)
37
- super(*args, &block)
37
+ super
38
38
  @thing_filter = ThingFilter.new(
39
39
  self.class.filtered_attribute_names,
40
- label: Auth::Sanitizer.filtered_label,
40
+ label: Auth::Sanitizer.filtered_label
41
41
  )
42
42
  end
43
43
  end
@@ -93,16 +93,34 @@ module Auth
93
93
  #
94
94
  # @return [String]
95
95
  def inspect
96
- return super if thing_filter.things.empty?
96
+ inspected = super
97
+ return inspected if thing_filter.things.empty?
97
98
 
98
- inspected_vars = instance_variables.map do |var|
99
- if thing_filter.filtered?(var)
100
- "#{var}=#{thing_filter.label}"
101
- else
102
- "#{var}=#{instance_variable_get(var).inspect}"
99
+ redact_inspected_values(inspected.dup)
100
+ end
101
+
102
+ private
103
+
104
+ INSPECTED_STRING_VALUE = /"(?:(?:\\.)|[^"\\])*"/
105
+ INSPECTED_REDACTABLE_VALUE = /
106
+ (?:
107
+ (@([A-Za-z_]\w*[!?=]?)=) |
108
+ ([,{]\s*([A-Za-z_]\w*[!?=]?):\s*) |
109
+ ([,{]\s*:([A-Za-z_]\w*[!?=]?)\s*=>\s*) |
110
+ ([,{]\s*"([A-Za-z_]\w*[!?=]?)"\s*=>\s*)
111
+ )
112
+ #{INSPECTED_STRING_VALUE}
113
+ /x
114
+ private_constant :INSPECTED_STRING_VALUE, :INSPECTED_REDACTABLE_VALUE
115
+
116
+ def redact_inspected_values(inspected)
117
+ inspected.gsub(INSPECTED_REDACTABLE_VALUE) do |match|
118
+ captures = Regexp.last_match.captures
119
+ prefix, = captures.each_slice(2).detect do |(_candidate_prefix, candidate_key)|
120
+ thing_filter.things.include?(candidate_key)
103
121
  end
122
+ prefix ? "#{prefix}#{thing_filter.label}" : match
104
123
  end
105
- "#<#{self.class}:#{object_id} #{inspected_vars.join(", ")}>"
106
124
  end
107
125
  end
108
126
  end
data/lib/auth/sanitizer/sanitized_logger.rb CHANGED
@@ -219,7 +219,7 @@ module Auth
219
219
  # @param [String] message Logger message
220
220
  # @return [String] Sanitized logger message
221
221
  def sanitize_authorization_header(message)
222
- message.gsub(/(Authorization:\s*)(?:\"[^\"]*\"|[^\r\n]+)/i, "\\1\"#{thing_filter.label}\"")
222
+ message.gsub(/(Authorization:\s*)(?:"[^"]*"|[^\r\n]+)/i, "\\1\"#{thing_filter.label}\"")
223
223
  end
224
224
 
225
225
  # Redact JSON-style values for configured sensitive key names.
@@ -227,7 +227,7 @@ module Auth
227
227
  # @param [String] message Logger message
228
228
  # @return [String] Sanitized logger message
229
229
  def sanitize_json_pairs(message)
230
- message.gsub(/([\"'])(#{thing_filter.pattern_source})\1(\s*:\s*)([\"'])(.*?)\4/i) do
230
+ message.gsub(/(["'])(#{thing_filter.pattern_source})\1(\s*:\s*)(["'])(.*?)\4/i) do
231
231
  %(#{$1}#{$2}#{$1}#{$3}#{$4}#{thing_filter.label}#{$4})
232
232
  end
233
233
  end
@@ -237,7 +237,7 @@ module Auth
237
237
  # @param [String] message Logger message
238
238
  # @return [String] Sanitized logger message
239
239
  def sanitize_form_and_query_pairs(message)
240
- message.gsub(/(\b(?:#{thing_filter.pattern_source})=)([^&\s\"]+)/i, "\\1#{thing_filter.label}")
240
+ message.gsub(/(\b(?:#{thing_filter.pattern_source})=)([^&\s"]+)/i, "\\1#{thing_filter.label}")
241
241
  end
242
242
  end
243
243
  end
data/lib/auth/sanitizer/thing_filter.rb CHANGED
File without changes
data/lib/auth/sanitizer/version.rb CHANGED
@@ -3,7 +3,7 @@
3
3
  module Auth
4
4
  module Sanitizer
5
5
  module Version
6
- VERSION = "0.1.4"
6
+ VERSION = "0.2.0"
7
7
  end
8
8
  VERSION = Version::VERSION # Traditional Constant Location
9
9
  end
data/lib/auth/sanitizer.rb CHANGED
@@ -1,7 +1,13 @@
1
1
  # frozen_string_literal: true
2
2
 
3
+ require "version_gem"
4
+
3
5
  require_relative "sanitizer/version"
4
6
  require_relative "sanitizer/thing_filter"
5
7
  require_relative "sanitizer/core"
6
8
  require_relative "sanitizer/filtered_attributes"
7
9
  require_relative "sanitizer/sanitized_logger"
10
+
11
+ Auth::Sanitizer::Version.class_eval do
12
+ extend VersionGem::Basic
13
+ end
data/lib/auth_sanitizer/loader.rb CHANGED
@@ -22,12 +22,38 @@ module AuthSanitizer
22
22
  # @return [Module] isolated Auth::Sanitizer module
23
23
  def load_isolated
24
24
  namespace = Module.new
25
+ auth_namespace = Module.new
26
+ namespace.const_set(:Auth, auth_namespace)
27
+
25
28
  FILES.each do |relative_path|
26
29
  path = File.expand_path("../#{relative_path}", __dir__)
27
- namespace.module_eval(File.read(path), path, 1)
30
+ auth_namespace.module_eval(isolated_source(path), path, 1)
28
31
  end
32
+
29
33
  namespace.const_get(:Auth).const_get(:Sanitizer)
30
34
  end
35
+
36
+ private
37
+
38
+ # Remove the public top-level Auth wrapper before evaluating a file inside
39
+ # the anonymous Auth namespace. This keeps the normal files unchanged while
40
+ # avoiding Object::Auth leakage on runtimes where Module#module_eval still
41
+ # resolves nested module declarations through Object.
42
+ def isolated_source(path)
43
+ lines = File.readlines(path)
44
+ wrapper_index = lines.index("module Auth\n")
45
+ return lines.join.split("Auth::Sanitizer").join("Sanitizer") unless wrapper_index
46
+
47
+ lines.delete_at(wrapper_index)
48
+ closing_index = lines.rindex("end\n")
49
+ lines.delete_at(closing_index) if closing_index
50
+
51
+ wrapper_index.upto(lines.length - 1) do |index|
52
+ line = lines[index]
53
+ lines[index] = line.start_with?(" ") ? line[2..-1] : line
54
+ end
55
+ lines.join.split("Auth::Sanitizer").join("Sanitizer")
56
+ end
31
57
  end
32
58
  end
33
59
  end
data/sig/auth/sanitizer/version.rbs ADDED
@@ -0,0 +1,8 @@
1
+ module Auth
2
+ module Sanitizer
3
+ module Version
4
+ VERSION: String
5
+ end
6
+ VERSION: String
7
+ end
8
+ end
data/sig/auth/sanitizer.rbs CHANGED
File without changes
data.tar.gz.sig CHANGED
Binary file
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: auth-sanitizer
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.4
4
+ version: 0.2.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Peter H. Boling
@@ -64,6 +64,9 @@ dependencies:
64
64
  - - "~>"
65
65
  - !ruby/object:Gem::Version
66
66
  version: '2.0'
67
+ - - ">="
68
+ - !ruby/object:Gem::Version
69
+ version: 2.0.8
67
70
  type: :development
68
71
  prerelease: false
69
72
  version_requirements: !ruby/object:Gem::Requirement
@@ -71,6 +74,9 @@ dependencies:
71
74
  - - "~>"
72
75
  - !ruby/object:Gem::Version
73
76
  version: '2.0'
77
+ - - ">="
78
+ - !ruby/object:Gem::Version
79
+ version: 2.0.8
74
80
  - !ruby/object:Gem::Dependency
75
81
  name: bundler-audit
76
82
  requirement: !ruby/object:Gem::Requirement
@@ -145,20 +151,40 @@ dependencies:
145
151
  requirements:
146
152
  - - "~>"
147
153
  - !ruby/object:Gem::Version
148
- version: '1.0'
154
+ version: '2.0'
149
155
  - - ">="
150
156
  - !ruby/object:Gem::Version
151
- version: 1.0.10
157
+ version: 2.0.3
152
158
  type: :development
153
159
  prerelease: false
154
160
  version_requirements: !ruby/object:Gem::Requirement
155
161
  requirements:
156
162
  - - "~>"
157
163
  - !ruby/object:Gem::Version
158
- version: '1.0'
164
+ version: '2.0'
159
165
  - - ">="
160
166
  - !ruby/object:Gem::Version
161
- version: 1.0.10
167
+ version: 2.0.3
168
+ - !ruby/object:Gem::Dependency
169
+ name: turbo_tests2
170
+ requirement: !ruby/object:Gem::Requirement
171
+ requirements:
172
+ - - "~>"
173
+ - !ruby/object:Gem::Version
174
+ version: '3.1'
175
+ - - ">="
176
+ - !ruby/object:Gem::Version
177
+ version: 3.1.1
178
+ type: :development
179
+ prerelease: false
180
+ version_requirements: !ruby/object:Gem::Requirement
181
+ requirements:
182
+ - - "~>"
183
+ - !ruby/object:Gem::Version
184
+ version: '3.1'
185
+ - - ">="
186
+ - !ruby/object:Gem::Version
187
+ version: 3.1.1
162
188
  - !ruby/object:Gem::Dependency
163
189
  name: ruby-progressbar
164
190
  requirement: !ruby/object:Gem::Requirement
@@ -199,21 +225,21 @@ dependencies:
199
225
  requirements:
200
226
  - - "~>"
201
227
  - !ruby/object:Gem::Version
202
- version: '1.0'
228
+ version: '2.0'
203
229
  - - ">="
204
230
  - !ruby/object:Gem::Version
205
- version: 1.0.3
231
+ version: 2.0.1
206
232
  type: :development
207
233
  prerelease: false
208
234
  version_requirements: !ruby/object:Gem::Requirement
209
235
  requirements:
210
236
  - - "~>"
211
237
  - !ruby/object:Gem::Version
212
- version: '1.0'
238
+ version: '2.0'
213
239
  - - ">="
214
240
  - !ruby/object:Gem::Version
215
- version: 1.0.3
216
- description: "\U0001F7E5 Configurable KV output redaction. Sanitize/filter your secrets."
241
+ version: 2.0.1
242
+ description: "\U0001F48E Configurable KV output redaction. Sanitize/filter your secrets."
217
243
  email:
218
244
  - floss@galtzo.com
219
245
  executables: []
@@ -224,8 +250,8 @@ extra_rdoc_files:
224
250
  - CODE_OF_CONDUCT.md
225
251
  - CONTRIBUTING.md
226
252
  - FUNDING.md
253
+ - LICENSE.md
227
254
  - README.md
228
- - REEK
229
255
  - RUBOCOP.md
230
256
  - SECURITY.md
231
257
  files:
@@ -234,10 +260,11 @@ files:
234
260
  - CODE_OF_CONDUCT.md
235
261
  - CONTRIBUTING.md
236
262
  - FUNDING.md
263
+ - LICENSE.md
237
264
  - README.md
238
- - REEK
239
265
  - RUBOCOP.md
240
266
  - SECURITY.md
267
+ - certs/pboling.pem
241
268
  - lib/auth/sanitizer.rb
242
269
  - lib/auth/sanitizer/core.rb
243
270
  - lib/auth/sanitizer/filtered_attributes.rb
@@ -246,15 +273,16 @@ files:
246
273
  - lib/auth/sanitizer/version.rb
247
274
  - lib/auth_sanitizer/loader.rb
248
275
  - sig/auth/sanitizer.rbs
276
+ - sig/auth/sanitizer/version.rbs
249
277
  homepage: https://github.com/ruby-oauth/auth-sanitizer
250
278
  licenses:
251
279
  - MIT
252
280
  metadata:
253
- homepage_uri: https://auth-sanitizer.galtzo.com/
254
- source_code_uri: https://github.com/ruby-oauth/auth-sanitizer/tree/v0.1.4
255
- changelog_uri: https://github.com/ruby-oauth/auth-sanitizer/blob/v0.1.4/CHANGELOG.md
281
+ homepage_uri: https://auth-sanitizer.galtzo.com
282
+ source_code_uri: https://github.com/ruby-oauth/auth-sanitizer/tree/v0.2.0
283
+ changelog_uri: https://github.com/ruby-oauth/auth-sanitizer/blob/v0.2.0/CHANGELOG.md
256
284
  bug_tracker_uri: https://github.com/ruby-oauth/auth-sanitizer/issues
257
- documentation_uri: https://www.rubydoc.info/gems/auth-sanitizer/0.1.4
285
+ documentation_uri: https://www.rubydoc.info/gems/auth-sanitizer/0.2.0
258
286
  funding_uri: https://github.com/sponsors/pboling
259
287
  wiki_uri: https://github.com/ruby-oauth/auth-sanitizer/wiki
260
288
  news_uri: https://www.railsbling.com/tags/auth-sanitizer
@@ -262,7 +290,7 @@ metadata:
262
290
  rubygems_mfa_required: 'true'
263
291
  rdoc_options:
264
292
  - "--title"
265
- - "auth-sanitizer - \U0001F7E5 Configurable KV output redaction"
293
+ - "auth-sanitizer - \U0001F48E Configurable KV output redaction"
266
294
  - "--main"
267
295
  - README.md
268
296
  - "--exclude"
@@ -283,7 +311,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
283
311
  - !ruby/object:Gem::Version
284
312
  version: '0'
285
313
  requirements: []
286
- rubygems_version: 4.0.11
314
+ rubygems_version: 4.0.10
287
315
  specification_version: 4
288
- summary: "\U0001F7E5 Configurable KV output redaction"
316
+ summary: "\U0001F48E Configurable KV output redaction"
289
317
  test_files: []
metadata.gz.sig CHANGED
Binary file
data/REEK DELETED
File without changes