chronos-ruby 0.1.0.pre.2 → 0.2.0.pre.1

data/lib/chronos/core/sensitive_value_filter.rb

@@ -0,0 +1,118 @@
+module Chronos
+  module Core
+    # Redacts recognized secret and personal-data patterns inside strings.
+    #
+    # @responsibility Detect bounded sensitive value formats independently of hash-key policy.
+    # @motivation Protect exception messages and allowlisted fields where no sensitive key exists.
+    # @limits Detection is conservative, validates documents and cards, and does not cover every format.
+    # @collaborators Sanitizer.
+    # @thread_safety Immutable after construction and safe to share between capture calls.
+    # @compatibility Ruby 2.2.10 through Ruby 2.6.
+    # @example
+    #   filter.call("person@example.com") #=> "[FILTERED_EMAIL]"
+    # @errors Invalid encodings become a filtered placeholder.
+    # @performance Applies a fixed set of regular expressions to each bounded string.
+    class SensitiveValueFilter
+      FILTERED = "[FILTERED]".freeze
+      FILTERED_EMAIL = "[FILTERED_EMAIL]".freeze
+      FILTERED_DOCUMENT = "[FILTERED_DOCUMENT]".freeze
+      FILTERED_CARD = "[FILTERED_CARD]".freeze
+      FILTERED_JWT = "[FILTERED_JWT]".freeze
+
+      EMAIL_PATTERN = /\b[A-Z0-9._%+\-]+@[A-Z0-9.\-]+\.[A-Z]{2,}\b/i
+      JWT_PATTERN = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/
+      BEARER_PATTERN = /\bBearer\s+[^\s,;]+/i
+      CPF_PATTERN = /\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/
+      CNPJ_PATTERN = %r{\b\d{2}\.?\d{3}\.?\d{3}/?\d{4}-?\d{2}\b}
+      IPV4_PATTERN = /\b(?:\d{1,3}\.){3}\d{1,3}\b/
+      CARD_PATTERN = /\b(?:\d[ -]?){12,18}\d\b/
+
+      def initialize(anonymize_ip)
+        @anonymize_ip = anonymize_ip
+        freeze
+      end
+
+      def call(value)
+        result = safe_string(value)
+        result = result.gsub(BEARER_PATTERN, "Bearer #{FILTERED}") if result =~ BEARER_PATTERN
+        result = result.gsub(JWT_PATTERN, FILTERED_JWT) if result.count(".") >= 2
+        result = result.gsub(EMAIL_PATTERN, FILTERED_EMAIL) if result.include?("@")
+        result = redact_numeric_values(result) if result.count("0-9") >= 11
+        @anonymize_ip && result.count(".") >= 3 ? anonymize_ipv4(result) : result
+      rescue StandardError
+        FILTERED
+      end
+
+      private
+
+      def redact_numeric_values(value)
+        result = redact_documents(value)
+        value.count("0-9") >= 13 ? redact_cards(result) : result
+      end
+
+      def redact_cards(value)
+        value.gsub(CARD_PATTERN) do |candidate|
+          luhn_valid?(candidate) ? FILTERED_CARD : candidate
+        end
+      end
+
+      def redact_documents(value)
+        result = value.gsub(CNPJ_PATTERN) do |candidate|
+          valid_cnpj?(candidate) ? FILTERED_DOCUMENT : candidate
+        end
+        result.gsub(CPF_PATTERN) do |candidate|
+          valid_cpf?(candidate) ? FILTERED_DOCUMENT : candidate
+        end
+      end
+
+      def valid_cpf?(candidate)
+        digits = candidate.gsub(/\D/, "").chars.map(&:to_i)
+        return false if digits.uniq.size == 1
+
+        digits[9] == document_digit(digits.first(9), (2..10).to_a.reverse) &&
+          digits[10] == document_digit(digits.first(10), (2..11).to_a.reverse)
+      end
+
+      def valid_cnpj?(candidate)
+        digits = candidate.gsub(/\D/, "").chars.map(&:to_i)
+        return false if digits.uniq.size == 1
+
+        first_weights = [5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2]
+        second_weights = [6] + first_weights
+        digits[12] == document_digit(digits.first(12), first_weights) &&
+          digits[13] == document_digit(digits.first(13), second_weights)
+      end
+
+      def document_digit(digits, weights)
+        remainder = digits.each_with_index.inject(0) do |sum, (digit, index)|
+          sum + (digit * weights[index])
+        end % 11
+        remainder < 2 ? 0 : 11 - remainder
+      end
+
+      def luhn_valid?(candidate)
+        digits = candidate.gsub(/\D/, "").chars.map(&:to_i)
+        return false unless digits.length.between?(13, 19)
+
+        sum = digits.reverse.each_with_index.inject(0) do |total, (digit, index)|
+          doubled = index.odd? ? digit * 2 : digit
+          total + (doubled > 9 ? doubled - 9 : doubled)
+        end
+        (sum % 10).zero?
+      end
+
+      def anonymize_ipv4(value)
+        value.gsub(IPV4_PATTERN) do |candidate|
+          octets = candidate.split(".").map(&:to_i)
+          octets.all? { |octet| octet.between?(0, 255) } ? "#{octets[0, 3].join('.')}.0" : candidate
+        end
+      end
+
+      def safe_string(value)
+        value.encode("UTF-8", :invalid => :replace, :undef => :replace, :replace => "�")
+      rescue StandardError
+        FILTERED
+      end
+    end
+  end
+end

data/lib/chronos/internal/bounded_queue.rb

@@ -4,7 +4,7 @@ module Chronos
     #
     # @responsibility Accept events up to a limit and count accepted and dropped items.
     # @motivation Prevent telemetry bursts from growing application memory indefinitely.
-    # @limits Version 0.1 drops the newest item when full and does not persist to disk.
+    # @limits Version 0.2 drops the newest item when full and does not persist to disk.
     # @collaborators WorkerPool.
     # @thread_safety Mutex and condition variable protect all mutable state.
     # @compatibility Ruby 2.2.10 through Ruby 2.6 and fork-aware callers.

data/lib/chronos/internal/worker_pool.rb

@@ -4,7 +4,7 @@ module Chronos
     #
     # @responsibility Start workers on first use, deliver events, flush, and shut down predictably.
     # @motivation Keep serialization and network delivery outside the caller's critical path.
-    # @limits Version 0.1 does not retry failed deliveries or persist a backlog.
+    # @limits Version 0.2 does not retry failed deliveries or persist a backlog.
     # @collaborators BoundedQueue, Transport, and SafeLogger.
     # @thread_safety Internal state is synchronized and active delivery is counted.
     # @compatibility Ruby 2.2.10 through Ruby 2.6; workers are recreated after fork.

data/lib/chronos/ports/transport.rb

@@ -4,7 +4,7 @@ module Chronos
     #
     # @responsibility Describe delivery outcome and retry classification.
     # @motivation Keep HTTP implementation details outside the application layer.
-    # @limits It does not schedule retries; retry is outside version 0.1.
+    # @limits It does not schedule retries; retry is outside version 0.2.
     # @thread_safety Immutable after construction.
     # @compatibility Ruby 2.2.10 through Ruby 2.6.
     class TransportResult

data/lib/chronos/version.rb

@@ -1,4 +1,4 @@
 module Chronos
   # Current version of the legacy Chronos Ruby agent.
-  VERSION = "0.1.0.pre.2".freeze
+  VERSION = "0.2.0.pre.1".freeze
 end

data/lib/chronos.rb

@@ -11,6 +11,9 @@ require "chronos/core/backtrace_parser"
 require "chronos/core/exception_cause_collector"
 require "chronos/core/runtime_info"
 require "chronos/core/notice_builder"
+require "chronos/core/sensitive_value_filter"
+require "chronos/core/sanitizer"
+require "chronos/core/safe_serializer"
 require "chronos/core/payload_serializer"
 require "chronos/ports/transport"
 require "chronos/internal/safe_logger"
@@ -24,7 +27,7 @@ require "chronos/agent"
 #
 # @responsibility Configure the agent and expose its small lifecycle API.
 # @motivation Give applications a stable entry point while internals evolve.
-# @limits Version 0.1 captures Ruby exceptions only; integrations arrive later.
+# @limits Version 0.2 captures Ruby exceptions manually; integrations arrive later.
 # @collaborators Configuration and Agent.
 # @thread_safety Agent replacement and lookup are protected by a mutex.
 # @compatibility Ruby 2.2.10 through Ruby 2.6.

metadata

@@ -1,11 +1,11 @@
 --- !ruby/object:Gem::Specification
 name: chronos-ruby
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre.2
+  version: 0.2.0.pre.1
 platform: ruby
 authors:
 - Antonio Jefferson
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
 date: 2026-07-20 00:00:00.000000000 Z
@@ -30,14 +30,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '12.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 12.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '12.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -56,16 +62,16 @@ dependencies:
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.47.1
+        version: 0.49.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.47.1
+        version: 0.49.0
 description: Base do cliente Chronos para excecoes, telemetria e observabilidade em
   aplicacoes Ruby legadas.
 email:
@@ -95,6 +101,8 @@ files:
 - docs/modules/async-queue.md
 - docs/modules/configuration.md
 - docs/modules/notice-pipeline.md
+- docs/modules/sanitization.md
+- docs/modules/serialization.md
 - docs/modules/transport.md
 - docs/performance.md
 - docs/privacy-lgpd.md
@@ -113,6 +121,9 @@ files:
 - lib/chronos/core/notice_builder.rb
 - lib/chronos/core/payload_serializer.rb
 - lib/chronos/core/runtime_info.rb
+- lib/chronos/core/safe_serializer.rb
+- lib/chronos/core/sanitizer.rb
+- lib/chronos/core/sensitive_value_filter.rb
 - lib/chronos/errors.rb
 - lib/chronos/internal.rb
 - lib/chronos/internal/bounded_queue.rb
@@ -131,7 +142,7 @@ metadata:
   homepage_uri: https://github.com/antoniojefferson/chronos-ruby
   source_code_uri: https://github.com/antoniojefferson/chronos-ruby
   changelog_uri: https://github.com/antoniojefferson/chronos-ruby/blob/main/CHANGELOG.md
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -149,8 +160,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.1
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.4.22
+signing_key:
 specification_version: 4
 summary: Cliente Ruby para captura de eventos do Chronos
 test_files: []