eventhub-processor2 1.28.2 → 1.29.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd2f7112cce3b298538f8fa33ad0218ced28e2c86a2064b8cd6054df7e5a5718
-  data.tar.gz: 759bcd489e715c26146e82982f1c894fa3a97615be8c30334159d719cee8f4a6
+  metadata.gz: ebef86c063318afa67b5cc9413207ff62b476b2d21f74b273bc38a6e4f1e27f0
+  data.tar.gz: 07d8a05aa5b8e9b1ded3c8ecef9ebf57e7d1863a0da9befb29872037126c57f2
 SHA512:
-  metadata.gz: aeacaf0d8a2878add3b3b7081f8a386cff4bc996fc66f0ca46832d898cd732e71f8f2efd0009510398fc7ef9ef7fa944ec5f66892e2a5304707c79d52f222921
-  data.tar.gz: b8b0d57be7bc929b3262b6092e8cac7989c1341071c43c69e7ab1556b78902088d6dc6cc6112eaea48896d053a7d528ed0f1a594a01df845c7a765bd767684f4
+  metadata.gz: aa5d0e5a661e0517bd7742844aa8bada9649605113bbf1aa4ca8a750b09a199552aeda5bbcbc8d9c833b1c8c39ae32551d4c6fa99c9cd0836a08fd1ab9349751
+  data.tar.gz: adc18094fa6813a9273259491cc4ed546ce00371b677b221b9153785c8a8d08ac6def9a7416ba41c619a5a48ac085a550d3e1a2f894f2b5d3bdc13ef6e2d6d87

data/.github/workflows/01_test.yml

@@ -27,7 +27,7 @@ jobs:
 
     name: Ruby ${{ matrix.ruby }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1

data/.github/workflows/02_test_build_and_release.yml

@@ -13,7 +13,7 @@ jobs:
       CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
@@ -41,7 +41,7 @@ jobs:
 
     steps:
     - name: Checkout current code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         ref: main
 

data/.tool-versions

@@ -1 +1 @@
-ruby 4.0.4
+ruby 4.0.6

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog of EventHub::Processor2
 
+# 1.29.1 / 2026-08-26
+
+* Docs configuration page: sensitive keywords now only redact leaf values, not hash sections named after one (e.g. `database.pool` stays visible, `database.password` stays redacted).
+
+# 1.29.0 / 2026-08-26
+
+* Docs configuration page: sensitive keys now match by substring with an extended default list (e.g. `base_url`, `api_port` are redacted automatically). Exceptions like `vhost` stay visible and can be customized via `non_sensitive_keys`, analogous to `sensitive_keys`. See README for details.
+* Docs configuration page: redaction keeps hash/array structures visible and masks only the scalar values inside.
+* Test coverage raised to 100% lines; removed a dead duplicate route mount in the HTTP listener.
+
 # 1.28.2 / 2026-05-20
 
 * Fix `CorrelationId.current` leaking across messages on the same Bunny consumer thread. `CorrelationId.with` now always saves and restores, even when called with nil/empty. Symptom in production: deadletter messages stamped with an earlier message's `execution_id`.

data/README.md

@@ -499,7 +499,7 @@ end
 
 ### Configuration
 
-Displays the active configuration as an HTML table. Sensitive values (passwords, tokens, keys) are automatically redacted at any depth — keys matching the sensitive list are masked whether they appear at the top level, inside nested hashes, or inside hashes nested in arrays.
+Displays the active configuration as an HTML table. Sensitive values (passwords, tokens, keys) are automatically redacted at any depth — keys matching the sensitive list are masked whether they appear at the top level, inside nested hashes, or inside hashes nested in arrays. The structure is always preserved: when a sensitive key holds a hash or array, its keys stay visible and only the scalar values inside are replaced by `***`.
 
 ```
 GET {base_path}/docs/configuration
@@ -507,7 +507,7 @@ GET {base_path}/docs/configuration
 
 **Response:** `200 OK` with HTML page
 
-By default, the following keys are redacted: `password`, `secret`, `token`, `api_key`, `credential`, `username`, `user`, `login`. You can customize the list by defining a `sensitive_keys` method in your processor:
+Matching is by substring: a key is redacted if it *contains* one of the sensitive patterns (case-insensitive). By default, the patterns are: `password`, `secret`, `token`, `api_key`, `credential`, `user`, `login`, `host`, `port`, `database`, `instance`, `url`, `endpoint`, `scheme`. So `base_url`, `api_port`, `username`, or `userpwd` are redacted as well. `vhost` is an explicit exception and stays visible, even though it contains `host`. You can customize the list by defining a `sensitive_keys` method in your processor:
 
 ```ruby
 # Override the entire list
@@ -525,6 +525,17 @@ class MyProcessor < EventHub::Processor2
 end
 ```
 
+Exceptions work the other way around: keys listed as exceptions are never redacted, even if they match a sensitive pattern. Unlike the patterns, exceptions match the whole key exactly (case-insensitive). The default is `vhost`; you can customize the list by defining a `non_sensitive_keys` method:
+
+```ruby
+# Keep username and user visible although they match the user pattern
+class MyProcessor < EventHub::Processor2
+  def non_sensitive_keys
+    EventHub::DocsRenderer::DEFAULT_NON_SENSITIVE_KEYS + %w[username user]
+  end
+end
+```
+
 Or override the entire page by defining a `configuration_as_html` method:
 
 ```ruby

data/eventhub-processor2.gemspec

@@ -32,6 +32,6 @@ Gem::Specification.new do |spec|
 
   spec.add_development_dependency "rake", "~> 13.2"
   spec.add_development_dependency "rspec", "~> 3.13"
-  spec.add_development_dependency "simplecov", "~> 0.21"
+  spec.add_development_dependency "simplecov", "~> 1.0"
   spec.add_development_dependency "standard", "~> 1.39"
 end

data/lib/eventhub/actor_listener_http.rb

@@ -43,13 +43,12 @@ module EventHub
     end
 
     def mount_resources
-      # Redirect base path to docs
+      # Redirect base path to docs. WEBrick normalizes mount points by
+      # stripping the trailing slash, so this single mount serves both
+      # "#{@base_path}" and "#{@base_path}/".
       @server.mount_proc @base_path do |req, res|
         handle_base_redirect(req, res)
       end
-      @server.mount_proc "#{@base_path}/" do |req, res|
-        handle_base_redirect(req, res)
-      end
 
       # API resources
       @server.mount_proc "#{@base_path}/heartbeat" do |req, res|

data/lib/eventhub/docs_renderer.rb

@@ -159,29 +159,30 @@ module EventHub
       intro + filter + config_to_html_table(config) + script
     end
 
-    def config_to_html_table(hash, depth = 0, prefix = "")
+    def config_to_html_table(hash, depth = 0, prefix = "", redact: false)
       rows = hash.map do |key, value|
         full_key = prefix.empty? ? key.to_s : "#{prefix}.#{key}"
-        if sensitive_key?(key) && !value.nil? && !(value.respond_to?(:empty?) && value.empty?)
-          "<tr><td class=\"config-key\">#{ERB::Util.html_escape(full_key)}</td><td>#{redacted_html}</td></tr>"
-        elsif depth == 0 && value.is_a?(Hash) && !value.empty?
+        hide = redact_value?(key, value, redact)
+        if depth == 0 && value.is_a?(Hash) && !value.empty?
           "<tr class=\"is-section is-section-top\"><td colspan=\"2\"><strong>#{ERB::Util.html_escape(full_key)}</strong></td></tr>\n" \
-          "#{config_to_html_table(value, 1, full_key)}"
+          "#{config_to_html_table(value, 1, full_key, redact: hide)}"
         elsif value.is_a?(Hash) && value.empty?
           "<tr><td class=\"config-key\">#{ERB::Util.html_escape(full_key)}</td><td><span class=\"not-set\">(empty)</span></td></tr>"
         elsif value.is_a?(Hash) && value.values.all? { |v| v.is_a?(Hash) && v.empty? }
           items = value.keys.map { |k| "<li>#{ERB::Util.html_escape(k)}</li>" }.join("\n")
           "<tr><td class=\"config-key\">#{ERB::Util.html_escape(full_key)}</td><td><ul class=\"config-array\">#{items}</ul></td></tr>"
         elsif value.is_a?(Hash) && compact_hash?(value)
-          "<tr><td class=\"config-key\">#{ERB::Util.html_escape(full_key)}</td><td>#{format_nested_value(value)}</td></tr>"
+          "<tr><td class=\"config-key\">#{ERB::Util.html_escape(full_key)}</td><td>#{format_nested_value(value, redact: hide)}</td></tr>"
         elsif value.is_a?(Hash)
           "<tr class=\"is-section\"><td colspan=\"2\"><strong>#{ERB::Util.html_escape(full_key)}</strong></td></tr>\n" \
-          "#{config_to_html_table(value, depth + 1, full_key)}"
+          "#{config_to_html_table(value, depth + 1, full_key, redact: hide)}"
         elsif value.is_a?(Array)
-          format_array_rows(full_key, key, value, depth)
+          format_array_rows(full_key, value, depth, redact: hide)
         else
           display_value = if value.nil? || value.to_s.strip.empty?
             "<span class=\"not-set\">(not set)</span>"
+          elsif hide
+            redacted_html
           else
             ERB::Util.html_escape(value.to_s)
           end
@@ -196,44 +197,42 @@ module EventHub
       end
     end
 
-    def format_array_rows(full_key, key, array, _depth)
+    def format_array_rows(full_key, array, _depth, redact: false)
       return "<tr><td class=\"config-key\">#{ERB::Util.html_escape(full_key)}</td><td><span class=\"not-set\">(empty)</span></td></tr>" if array.empty?
 
-      if sensitive_key?(key)
-        return "<tr><td class=\"config-key\">#{ERB::Util.html_escape(full_key)}</td><td>#{redacted_html}</td></tr>"
-      end
-
-      inner = array.map { |item| format_array_item(item) }.join("\n")
+      inner = array.map { |item| format_array_item(item, redact: redact) }.join("\n")
       "<tr><td class=\"config-key\">#{ERB::Util.html_escape(full_key)}</td><td><ul class=\"config-array\">#{inner}</ul></td></tr>"
     end
 
-    def format_array_item(item)
+    def format_array_item(item, redact: false)
       if item.is_a?(Hash)
         rows = item.map do |k, v|
-          value = sensitive_key?(k) ? redacted_html : format_nested_value(v)
-          "<tr><td>#{ERB::Util.html_escape(k)}</td><td>#{value}</td></tr>"
+          hide = redact_value?(k, v, redact)
+          "<tr><td>#{ERB::Util.html_escape(k)}</td><td>#{format_nested_value(v, redact: hide)}</td></tr>"
         end.join
         "<li><table class=\"table is-bordered is-narrow config-subtable\">#{rows}</table></li>"
       elsif item.is_a?(Array)
-        inner = item.map { |i| format_array_item(i) }.join("\n")
+        inner = item.map { |i| format_array_item(i, redact: redact) }.join("\n")
         "<li><ul class=\"config-array\">#{inner}</ul></li>"
       else
-        "<li>#{ERB::Util.html_escape(item.to_s)}</li>"
+        "<li>#{redact ? redacted_html : ERB::Util.html_escape(item.to_s)}</li>"
       end
     end
 
-    def format_nested_value(value)
+    def format_nested_value(value, redact: false)
       if value.is_a?(Hash)
         rows = value.map do |k, v|
-          inner = sensitive_key?(k) ? redacted_html : format_nested_value(v)
-          "<tr><td>#{ERB::Util.html_escape(k)}</td><td>#{inner}</td></tr>"
+          hide = redact_value?(k, v, redact)
+          "<tr><td>#{ERB::Util.html_escape(k)}</td><td>#{format_nested_value(v, redact: hide)}</td></tr>"
         end.join
         "<table class=\"table is-bordered is-narrow config-subtable\">#{rows}</table>"
       elsif value.is_a?(Array)
-        items = value.map { |i| format_array_item(i) }.join("\n")
+        items = value.map { |i| format_array_item(i, redact: redact) }.join("\n")
         "<ul class=\"config-array\">#{items}</ul>"
       elsif value.nil? || value.to_s.strip.empty?
         "<span class=\"not-set\">(not set)</span>"
+      elsif redact
+        redacted_html
       else
         ERB::Util.html_escape(value.to_s)
       end
@@ -253,15 +252,34 @@ module EventHub
       end
     end
 
-    DEFAULT_SENSITIVE_KEYS = %w[password secret token api_key credential username user login].freeze
+    DEFAULT_SENSITIVE_KEYS = %w[password secret token api_key credential user login host port database instance url endpoint scheme].freeze
+    DEFAULT_NON_SENSITIVE_KEYS = %w[vhost].freeze
+
+    # A sensitive keyword only triggers redaction on leaf nodes (scalars and
+    # arrays). A hash named e.g. "database" stays visible; its keys are
+    # checked individually instead.
+    def redact_value?(key, value, inherited)
+      inherited || (!value.is_a?(Hash) && sensitive_key?(key))
+    end
 
     def sensitive_key?(key)
+      normalized = key.to_s.downcase
+      return false if non_sensitive_keys.any? { |exception| normalized == exception.downcase }
+
       keys = if @processor&.class&.method_defined?(:sensitive_keys)
         @processor.sensitive_keys
       else
         DEFAULT_SENSITIVE_KEYS
       end
-      keys.any? { |pattern| key.to_s.downcase == pattern.downcase }
+      keys.any? { |pattern| normalized.include?(pattern.downcase) }
+    end
+
+    def non_sensitive_keys
+      if @processor&.class&.method_defined?(:non_sensitive_keys)
+        @processor.non_sensitive_keys
+      else
+        DEFAULT_NON_SENSITIVE_KEYS
+      end
     end
 
     def markdown_to_html(markdown)

data/lib/eventhub/version.rb

@@ -1,3 +1,3 @@
 module EventHub
-  VERSION = "1.28.2".freeze
+  VERSION = "1.29.1".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: eventhub-processor2
 version: !ruby/object:Gem::Version
-  version: 1.28.2
+  version: 1.29.1
 platform: ruby
 authors:
 - Steiner, Thomas
@@ -141,14 +141,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.21'
+        version: '1.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.21'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: standard
   requirement: !ruby/object:Gem::Requirement
@@ -247,7 +247,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Next generation gem to build ruby based eventhub processor
 test_files: []