auth-sanitizer 0.1.5 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c91251e1007c195c50ee201a4c41cd42b618ca427a6be9cbbbf6fbb9e27c9954
-  data.tar.gz: 07dc8e308d6177992350f763615c9abecb77fc4e807d6b34d332e1a1880b17de
+  metadata.gz: ee9c13c8e833242ae444802320b2a44204222f09529c8d7d588bbb7f725e2dff
+  data.tar.gz: 7fc39449d814609f58f5c7b6ce432bbb14fb532e5cf84e0a3f296e7e2e770763
 SHA512:
-  metadata.gz: 22a80ac4d3a37a9570bb2cc875c5f725b989a6b6e93be87d03c9e0145e598deadf8da4c90114f2a5ad4b28ab253f491d31679c7b459015571069f52aac651750
-  data.tar.gz: 8a03ebabaebda0de8ea0144e613fe5198d6f03d8b1612e431a272fab6bed71f846f75794932714d0abd7a34c70925ea08b6e582c48a01d61132e4bddcd019e7d
+  metadata.gz: 1c3fdbb99b0835a7694818b891daebe08bdc6e1cd95348e214970bf02c3ece6caa41fc9ae9d22a118720c9064baf16c066c0a7718121362b7d7141622ec2ccd9
+  data.tar.gz: 9057c5111136395c5418bfbd2acde6206d42a7c4b19d67e7fff8ae5449675019608557d4582ac53bd62f9b1792cdf56a186ffaac10989b5148a180e2cc48efcd

data/CHANGELOG.md

@@ -30,6 +30,24 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [0.2.0] - 2026-06-04
+
+- TAG: [v0.2.0][0.2.0t]
+- COVERAGE: 100.00% -- 145/145 lines in 6 files
+- BRANCH COVERAGE: 100.00% -- 28/28 branches in 6 files
+- 84.62% documented
+
+### Changed
+
+- Changed `FilteredAttributes#inspect` to redact narrow patterns from
+  `super.inspect` instead of rebuilding object inspect output, preserving host
+  inspect behavior.
+
+### Fixed
+
+- Redacted configured attributes inside standard Ruby hash inspect fragments,
+  including nested attribute hashes.
+
 ## [0.1.5] - 2026-06-03
 
 - TAG: [v0.1.5][0.1.5t]
@@ -119,7 +137,9 @@ Please file a bug if you notice a violation of semantic versioning.
 
 - Initial release
 
-[Unreleased]: https://github.com/ruby-oauth/auth-sanitizer/compare/v0.1.5...HEAD
+[Unreleased]: https://github.com/ruby-oauth/auth-sanitizer/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/ruby-oauth/auth-sanitizer/compare/v0.1.5...v0.2.0
+[0.2.0t]: https://github.com/ruby-oauth/auth-sanitizer/releases/tag/v0.2.0
 [0.1.5]: https://github.com/ruby-oauth/auth-sanitizer/compare/v0.1.4...v0.1.5
 [0.1.5t]: https://github.com/ruby-oauth/auth-sanitizer/releases/tag/v0.1.5
 [0.1.4]: https://github.com//ruby-oauth/auth-sanitizer/compare/v0.1.3...v0.1.4

data/README.md

@@ -27,7 +27,7 @@ inspection and log output.
 The gem is intentionally narrow in scope. It does not change HTTP requests, token objects, persistence, or application
 configuration for you. Instead, it gives host gems and applications two reusable redaction surfaces:
 
-- `Auth::Sanitizer::FilteredAttributes` redacts selected instance variables from `#inspect`.
+- `Auth::Sanitizer::FilteredAttributes` redacts selected attributes from standard Ruby `#inspect` output.
 - `Auth::Sanitizer::SanitizedLogger` wraps an existing logger and redacts sensitive values from string log messages.
 
 Out of the box, logger sanitization filters the key names most commonly found in OAuth and OpenID Connect debug output:
@@ -357,8 +357,43 @@ class OAuthCredential
 end
 ```
 
-Declared names are matched against instance variable names. For example, `filtered_attributes :access_token` redacts
-`@access_token` in `#inspect`.
+`FilteredAttributes#inspect` delegates to `super.inspect` first, then redacts only narrow, standard Ruby inspect
+fragments for configured names. This preserves host object inspect behavior instead of rebuilding the object's output.
+
+For example, `filtered_attributes :access_token` redacts `@access_token="..."` in normal object inspect output:
+
+```ruby
+OAuthCredential.new("secret", Time.now).inspect
+# => #<OAuthCredential:0x... @access_token=[FILTERED], @expires_at=2026-06-04 08:00:00 -0600>
+```
+
+Configured names are also redacted when they appear as string-valued keys inside standard Ruby hash inspect fragments,
+which is useful for adapter models that store attributes in an internal hash:
+
+```ruby
+class IdentityRecord
+  include Auth::Sanitizer::FilteredAttributes
+
+  filtered_attributes :password_digest
+
+  def initialize(identity_data)
+    @identity_data = identity_data
+  end
+end
+
+IdentityRecord.new({id: 1, password_digest: "$2a$secret"}).inspect
+# => #<IdentityRecord:0x... @identity_data={id: 1, password_digest: [FILTERED]}>
+```
+
+The inspect redactor intentionally leaves unsupported or highly customized inspect formats unchanged. It only replaces
+quoted string values in these standard shapes:
+
+- `@name="value"`
+- `{name: "value"}`
+- `{:name => "value"}`
+- `{"name" => "value"}`
+
+This conservative behavior avoids breaking host models whose `inspect` output has application-specific formatting.
 
 Calling `filtered_attributes` again replaces the class-level list:
 
@@ -427,11 +462,12 @@ response = TokenResponse.new(
 )
 
 response.inspect
-# => #<TokenResponse:123456 @access_token=[FILTERED], @refresh_token=[FILTERED], @scope="profile email">
+# => #<TokenResponse:0x... @access_token=[FILTERED], @refresh_token=[FILTERED], @scope="profile email">
 ```
 
 Only the configured attributes are redacted. Other instance variables remain visible so inspected objects are still
-useful while debugging.
+useful while debugging. Inspect filtering is conservative: unsupported custom formats are left unchanged rather than
+risking a malformed `inspect` result.
 
 ### Redact Logger Output
 
@@ -875,7 +911,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.138-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.145-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/ruby-oauth/auth-sanitizer/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/auth/sanitizer/filtered_attributes.rb

@@ -93,16 +93,34 @@ module Auth
       #
       # @return [String]
       def inspect
-        return super if thing_filter.things.empty?
+        inspected = super
+        return inspected if thing_filter.things.empty?
 
-        inspected_vars = instance_variables.map do |var|
-          if thing_filter.filtered?(var)
-            "#{var}=#{thing_filter.label}"
-          else
-            "#{var}=#{instance_variable_get(var).inspect}"
+        redact_inspected_values(inspected.dup)
+      end
+
+      private
+
+      INSPECTED_STRING_VALUE = /"(?:(?:\\.)|[^"\\])*"/
+      INSPECTED_REDACTABLE_VALUE = /
+        (?:
+          (@([A-Za-z_]\w*[!?=]?)=) |
+          ([,{]\s*([A-Za-z_]\w*[!?=]?):\s*) |
+          ([,{]\s*:([A-Za-z_]\w*[!?=]?)\s*=>\s*) |
+          ([,{]\s*"([A-Za-z_]\w*[!?=]?)"\s*=>\s*)
+        )
+        #{INSPECTED_STRING_VALUE}
+      /x
+      private_constant :INSPECTED_STRING_VALUE, :INSPECTED_REDACTABLE_VALUE
+
+      def redact_inspected_values(inspected)
+        inspected.gsub(INSPECTED_REDACTABLE_VALUE) do |match|
+          captures = Regexp.last_match.captures
+          prefix, = captures.each_slice(2).detect do |(_candidate_prefix, candidate_key)|
+            thing_filter.things.include?(candidate_key)
           end
+          prefix ? "#{prefix}#{thing_filter.label}" : match
         end
-        "#<#{self.class}:#{object_id} #{inspected_vars.join(", ")}>"
       end
     end
   end

data/lib/auth/sanitizer/version.rb

@@ -3,7 +3,7 @@
 module Auth
   module Sanitizer
     module Version
-      VERSION = "0.1.5"
+      VERSION = "0.2.0"
     end
     VERSION = Version::VERSION # Traditional Constant Location
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: auth-sanitizer
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.2.0
 platform: ruby
 authors:
 - Peter H. Boling
@@ -279,10 +279,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://auth-sanitizer.galtzo.com
-  source_code_uri: https://github.com/ruby-oauth/auth-sanitizer/tree/v0.1.5
-  changelog_uri: https://github.com/ruby-oauth/auth-sanitizer/blob/v0.1.5/CHANGELOG.md
+  source_code_uri: https://github.com/ruby-oauth/auth-sanitizer/tree/v0.2.0
+  changelog_uri: https://github.com/ruby-oauth/auth-sanitizer/blob/v0.2.0/CHANGELOG.md
   bug_tracker_uri: https://github.com/ruby-oauth/auth-sanitizer/issues
-  documentation_uri: https://www.rubydoc.info/gems/auth-sanitizer/0.1.5
+  documentation_uri: https://www.rubydoc.info/gems/auth-sanitizer/0.2.0
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/ruby-oauth/auth-sanitizer/wiki
   news_uri: https://www.railsbling.com/tags/auth-sanitizer