karst 0.2.0 → 0.4.0

data/lib/karst/reproduction/curl.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "json"
+require "rack/utils"
+
+module Karst
+  module Reproduction
+    # Renders one Karst::Reproduction::Observation as a runnable cURL command.
+    #
+    # The command contains exactly what Karst sent, with redacted values
+    # replaced by placeholders -- never a header, parameter, or credential
+    # Karst invented to make the command look complete. If the request needs
+    # an API key Karst never sent, the command will not contain one; the
+    # recipe's observed execution (the halted callback that stopped the
+    # request) is what tells the engineer that, and it is honest evidence
+    # rather than a guess.
+    module Curl
+      # A deliberately generic local default. Callers that know the
+      # developer's real origin (the /karst panel does) pass it in; nothing
+      # here ever bakes in a deployed host, which would be neither portable
+      # nor safe to paste into a ticket.
+      DEFAULT_BASE_URL = "http://localhost:3000"
+
+      # Methods curl infers from the request shape anyway; spelling them out
+      # adds noise without adding meaning.
+      IMPLIED_METHODS = ["GET"].freeze
+
+      class << self
+        def render(observation, base_url: DEFAULT_BASE_URL)
+          parts = ["curl#{method_flag(observation)} #{quote(url(observation, base_url))}"]
+          header_flags(observation).each { |flag| parts << flag }
+          data = data_flag(observation)
+          parts << data if data
+          parts.join(" \\\n  ")
+        end
+
+        def url(observation, base_url = DEFAULT_BASE_URL)
+          query = Rack::Utils.build_nested_query(observation.query_params)
+          suffix = query.to_s.empty? ? "" : "?#{query}"
+          "#{base_url.to_s.chomp('/')}#{observation.url_path}#{suffix}"
+        end
+
+        private
+
+        def method_flag(observation)
+          method = observation.http_method.to_s.upcase
+          IMPLIED_METHODS.include?(method) ? "" : " -X #{method}"
+        end
+
+        def header_flags(observation)
+          observation.headers.map { |name, value| "-H #{quote("#{name}: #{value}")}" }
+        end
+
+        def data_flag(observation)
+          case observation.body_representation
+          when :json then "-d #{quote(JSON.pretty_generate(observation.body_params))}"
+          when :form then "-d #{quote(Rack::Utils.build_nested_query(observation.body_params))}"
+          when :opaque then "-d #{quote('<BODY>')}"
+          end
+        end
+
+        # Single quotes are the only shell quoting that treats every byte
+        # literally, so a JSON body full of double quotes, backslashes, and
+        # "$" needs no per-character escaping -- only the single quote
+        # itself, which closes the literal, emits an escaped quote, and
+        # reopens it.
+        def quote(value)
+          "'#{value.to_s.gsub("'", "'\\\\''")}'"
+        end
+      end
+    end
+  end
+end

data/lib/karst/reproduction/exercise.rb

@@ -0,0 +1,246 @@
+# frozen_string_literal: true
+
+require "json"
+require "rack/utils"
+require_relative "observation"
+require_relative "sanitizer"
+require_relative "../access/errors"
+require_relative "../access/local_path"
+require_relative "../access/probe"
+require_relative "../identity"
+
+module Karst
+  module Reproduction
+    # Issues exactly one request against the real application and reports what
+    # happened.
+    #
+    # This is deliberately not Access::Sweep with the GET restriction lifted.
+    # A sweep runs one route as up to 25 different users to answer "who can
+    # reach this"; running a mutating method that way would mean 25 real
+    # creates, 25 enqueued jobs, and 25 delivered mails, which is exactly why
+    # Sweep refuses anything but GET and will keep refusing. Reproduction
+    # answers a different question -- "what request exercises this behavior"
+    # -- and one request is the entire answer, so the blast radius is one
+    # request, always explicitly asked for, never automatic.
+    #
+    # The request is issued and observed by Access::Probe -- the same call,
+    # same identity lifecycle, same target window, and same same-connection
+    # rollback Access::Sweep uses for every principal it probes -- so a
+    # reproduced request reports exactly the evidence a sweep reports for
+    # the same request and identity. Containment has the same honest limit:
+    # database writes on this connection are rolled back; jobs, mail,
+    # outbound HTTP, files, and other connections are not. Callers are
+    # expected to say so out loud, and every Karst surface that exposes this
+    # does.
+    #
+    # What Exercise owns is the request itself and its presentation: which
+    # methods, headers, and bodies are acceptable, and how an observation
+    # becomes a sanitized, reproducible recipe. `principal` is requested
+    # identity (intent); the Observation this class returns carries a
+    # Karst::Identity::Evidence, never a bare echo of what was asked for. A
+    # caller that wants a genuinely anonymous probe passes
+    # Karst::Identity::ANONYMOUS (the default): Karst then establishes no
+    # identity and verifies at runtime that the application resolved none,
+    # exactly as an anonymous verify_access probe does -- a bare absence of a
+    # principal is not the same claim.
+    # rubocop:disable Metrics/ClassLength
+    class Exercise
+      METHODS = %w[GET HEAD POST PUT PATCH DELETE].freeze
+
+      JSON_CONTENT_TYPE = %r{\Aapplication/(?:[\w.+-]+\+)?json\b}i
+      private_constant :JSON_CONTENT_TYPE
+
+      FORM_CONTENT_TYPE = %r{\Aapplication/x-www-form-urlencoded\b}i
+      private_constant :FORM_CONTENT_TYPE
+
+      # Exactly ActionDispatch::Http::Headers' own idea of a header name.
+      # Anything outside this shape is passed through to the Rack env
+      # verbatim by Http::Headers#[]= rather than being prefixed with
+      # HTTP_, so a name like "rack.session" or "action_dispatch.request.
+      # parameters" would not be a header at all -- it would be a caller
+      # writing directly into the request environment Karst is supposed to
+      # be observing.
+      HEADER_NAME = /\A[A-Za-z0-9-]+\z/
+      private_constant :HEADER_NAME
+
+      # CGI variables Http::Headers maps a header name onto directly instead
+      # of prefixing. Letting a caller set these would let the request Karst
+      # issues differ from the request Karst reports -- a recipe describing a
+      # request nobody made. CONTENT_TYPE is deliberately absent: it is a
+      # real request header, and Karst sets it itself from `content_type`.
+      RESERVED = %w[
+        AUTH_TYPE CONTENT_LENGTH GATEWAY_INTERFACE HTTPS PATH_INFO PATH_TRANSLATED QUERY_STRING
+        REMOTE_ADDR REMOTE_HOST REMOTE_IDENT REMOTE_USER REQUEST_METHOD SCRIPT_NAME
+        SERVER_NAME SERVER_PORT SERVER_PROTOCOL SERVER_SOFTWARE
+      ].freeze
+      private_constant :RESERVED
+
+      # rubocop:disable Metrics/ParameterLists, Metrics/AbcSize, Metrics/MethodLength
+      def initialize(path:, http_method: "GET", body: nil, content_type: nil, headers: {},
+                     principal: Karst::Identity::ANONYMOUS, application: nil)
+        @http_method = http_method.to_s.strip.upcase
+        raise Access::UnsupportedMethod, "unsupported HTTP method" unless METHODS.include?(@http_method)
+
+        target = Access::LocalPath.parse(path)
+        @path = target.path
+        @query_params = Rack::Utils.parse_nested_query(target.query.to_s)
+        @body = body.to_s.empty? ? nil : body.to_s
+        @content_type = content_type.to_s.strip
+        raise ArgumentError, "a content type is required when sending a request body" if @body && @content_type.empty?
+
+        @headers = normalize_headers(headers)
+        # A bare nil is treated exactly like Karst::Identity::ANONYMOUS
+        # (the default) rather than as some third, identity-lifecycle-free
+        # state: a caller that passes no principal still gets a real
+        # anonymous probe, with the application's own runtime state verified
+        # rather than silently assumed.
+        @principal = principal || Karst::Identity::ANONYMOUS
+        @application = application || Rails.application
+        @probe = Access::Probe.new(@application)
+      end
+      # rubocop:enable Metrics/ParameterLists, Metrics/AbcSize, Metrics/MethodLength
+
+      def call
+        raise Access::Unavailable, "request reproduction is development-only" unless Rails.env.development?
+        raise Access::Unavailable, "Karst is disabled (config.enabled)" unless Karst.enabled?
+
+        # The query string travels in the target, exactly as a real client
+        # sends it; the body travels only as the body, so a GET never grows
+        # one it was not given.
+        build(@probe.call(principal: @principal, http_method: @http_method, target: target, body: @body,
+                          headers: outgoing_headers))
+      end
+
+      private
+
+      def target
+        query = Rack::Utils.build_nested_query(@query_params)
+        query.empty? ? @path : "#{@path}?#{query}"
+      end
+
+      def outgoing_headers
+        headers = @headers.dup
+        headers["Content-Type"] = @content_type unless @content_type.empty?
+        headers
+      end
+
+      # rubocop:disable Metrics/MethodLength, Metrics/AbcSize
+      def build(observed)
+        route = route_state(observed.route_params)
+        body_params, representation = body_state
+        Observation.new(
+          http_method: @http_method, url_path: displayed_path(route), query_params: sanitized_query,
+          route_params: route[:sanitized], body_params: body_params, body_representation: representation,
+          content_type: @content_type.empty? ? nil : @content_type, headers: Sanitizer.headers(outgoing_headers),
+          controller: observed.controller, action: observed.action,
+          controller_completed: observed.controller_completed,
+          status: observed.status, response_content_type: observed.response_content_type,
+          redirect: observed.redirect, halted_callback: observed.halted_callback&.to_s,
+          exception_class: observed.exception_class, exception_phase: observed.exception_phase,
+          rendered: observed.rendered, writes_observed: observed.write_count.positive?,
+          write_count: observed.write_count, database_rollback_attempted: true,
+          elapsed_ms: observed.elapsed_ms, identity: observed.identity,
+          unobserved: unobserved(observed, route).freeze
+        )
+      end
+      # rubocop:enable Metrics/MethodLength, Metrics/AbcSize
+
+      def unobserved(observed, route)
+        missing = []
+        missing << "controller" unless observed.controller
+        missing << "action" unless observed.action
+        missing << "controller_completed" if observed.controller_completed.nil?
+        missing << "route_params" unless route[:observed]
+        missing << "status" if observed.status.nil?
+        missing << "response_content_type" if observed.response_content_type.nil?
+        missing
+      end
+
+      # Absent route parameters (a 404, a routing error, a target that
+      # raised) mean Karst observed no route, which is reported as such
+      # rather than filled in.
+      def route_state(raw)
+        return { raw: {}, sanitized: {}, observed: false } unless raw
+
+        { raw: raw, sanitized: sanitize(raw), observed: true }
+      end
+
+      # A path segment that turned out to be a credential (a password-reset
+      # token, a signed id) is still sitting in the URL after the parameter
+      # itself was masked. Substituting the placeholder back into the path
+      # keeps the generated command from leaking through the one channel
+      # parameter filtering does not cover.
+      def displayed_path(route)
+        route[:sanitized].reduce(@path) do |path, (name, value)|
+          raw = route[:raw][name]
+          next path unless Sanitizer.masked?(value) && raw.is_a?(String) && !raw.empty?
+
+          path.gsub(raw, "<#{name.upcase}>")
+        end
+      end
+
+      def sanitized_query
+        sanitize(@query_params)
+      end
+
+      def sanitize(params)
+        Sanitizer.parameters(params, filters: filter_parameters)
+      end
+
+      # The reproduced application's own filter_parameters, never a global:
+      # Karst issued this request against @application, so @application's
+      # rules are the ones that decide what may be shown back. Always an
+      # Array, never nil -- Sanitizer.rails_filter treats a nil `filters` as
+      # "none given, read Rails.application" for callers outside a specific
+      # application, and this method already has one: if @application's own
+      # config raises, the honest answer is "this application declared no
+      # filters", never a silent fall-through to whatever Rails.application
+      # happens to be (which, when @application is a different object
+      # entirely -- as in a test harness -- would filter this application's
+      # parameters by a stranger's rules instead of its own).
+      def filter_parameters
+        Array(@application.config.filter_parameters)
+      rescue StandardError
+        []
+      end
+
+      def body_state
+        return [{}, :none] unless @body
+        return [sanitize(parsed_json), :json] if json_body?
+        return [sanitize(Rack::Utils.parse_nested_query(@body)), :form] if form_body?
+
+        [{}, :opaque]
+      rescue JSON::ParserError
+        [{}, :opaque]
+      end
+
+      def json_body?
+        @content_type.match?(JSON_CONTENT_TYPE) && parsed_json.is_a?(Hash)
+      end
+
+      def form_body?
+        @content_type.match?(FORM_CONTENT_TYPE)
+      end
+
+      def parsed_json
+        @parsed_json ||= JSON.parse(@body)
+      end
+
+      def normalize_headers(headers)
+        (headers || {}).each_with_object({}) do |(name, value), result|
+          key = name.to_s.strip
+          next if key.empty?
+
+          raise ArgumentError, "#{key.inspect} is not a request header name" unless header_name?(key)
+
+          result[key] = value.to_s
+        end
+      end
+
+      def header_name?(name)
+        name.match?(HEADER_NAME) && !RESERVED.include?(name.upcase.tr("-", "_"))
+      end
+    end
+    # rubocop:enable Metrics/ClassLength
+  end
+end

data/lib/karst/reproduction/observation.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require_relative "../value"
+
+module Karst
+  module Reproduction
+    # One request Karst actually issued, and what actually happened.
+    #
+    # Every member is either something Karst observed or an explicit
+    # placeholder standing in for something Karst redacted. Nothing here is
+    # inferred from routes, controller source, or strong-parameter
+    # declarations: a field Karst could not observe is nil and is named in
+    # #unobserved, so a consumer can say "Karst did not see this" instead of
+    # reading an absent value as a negative result.
+    #
+    # `identity` is a Karst::Identity::Evidence, carrying the identity Karst
+    # was asked to send this request under (requested), what Karst's own
+    # seam established (establishment), and what the application itself
+    # resolved while running the request (observed) -- exactly the same
+    # lifecycle Access::Sweep runs. There is deliberately no bare "principal"
+    # field here: a requested/assumed identity is intent, not evidence about
+    # what ran, and only `identity.confirmation` may be read to decide
+    # whether they agree.
+    #
+    # body_representation says how faithfully body_params describes what was
+    # sent:
+    #
+    #   :none    no request body was sent
+    #   :json    a JSON object body, parsed and sanitized key by key
+    #   :form    a form-encoded body, parsed and sanitized key by key
+    #   :opaque  a body Karst sent verbatim but will not echo back, because
+    #            it could not parse it well enough to sanitize it
+    #
+    # controller_completed, exception_class/exception_phase, and response
+    # (status/redirect/response_content_type) are three separate target-scoped
+    # facts, deliberately never inferred from one another:
+    #
+    #   controller_completed  true  -- process_action.action_controller finished
+    #                                  with no exception
+    #                         false  -- it finished carrying one
+    #                       nil/unobserved -- it never fired for this request
+    #                                  at all (nothing dispatched)
+    #
+    #   exception_phase        the most specific instrumentation-proven phase
+    #                          an observed exception occurred in --
+    #                          "controller", "render", or "unknown" -- derived
+    #                          by matching the exception object (and its
+    #                          #cause chain, since ActionView wraps a render
+    #                          exception in ActionView::Template::Error before
+    #                          it reaches the controller) against instrumented
+    #                          render events. nil whenever exception_class is
+    #                          nil: there is no phase to report for a request
+    #                          that raised nothing.
+    #
+    # Both are read off ActiveSupport::Notifications payloads captured while
+    # the target request ran, never off session.request/session.response --
+    # those two objects are only updated by ActionDispatch::Integration::Session
+    # *after* Rack::Test's app.call returns without raising. A target request
+    # that raises before producing a response leaves them holding whatever the
+    # previous request on the same session (identity establishment, most
+    # often) last wrote, so reading them post-hoc would silently attribute an
+    # earlier request's status/content type/location to this one.
+    #
+    # rendered is an Array of { virtual_path:, completed: } entries, one per
+    # ActionView template/partial/layout Karst observed the target request
+    # attempt (via "!render_template.action_view", the only notification
+    # exposing a template's own relative virtual_path rather than its
+    # absolute source file), in the order each one finished or raised.
+    # completed is false exactly when that specific render carried an
+    # exception; never inferred from the request's overall outcome.
+    Observation = Value.define(
+      :http_method, :url_path, :query_params, :route_params, :body_params, :body_representation,
+      :content_type, :headers, :controller, :action, :controller_completed,
+      :status, :response_content_type, :redirect,
+      :halted_callback, :exception_class, :exception_phase, :rendered, :writes_observed, :write_count,
+      :database_rollback_attempted, :elapsed_ms, :identity, :unobserved
+    ) do
+      def observed?(field)
+        !unobserved.include?(field.to_s)
+      end
+
+      def body?
+        body_representation != :none
+      end
+    end
+  end
+end

data/lib/karst/reproduction/sanitizer.rb

@@ -0,0 +1,210 @@
+# frozen_string_literal: true
+
+require "active_support/parameter_filter"
+require "uri"
+
+module Karst
+  module Reproduction
+    # Everything Karst is willing to show back to a developer about a request
+    # it issued passes through here first.
+    #
+    # The application's own Rails::Application#config.filter_parameters is the
+    # authority: Karst builds an ActiveSupport::ParameterFilter from it rather
+    # than reimplementing filtering, so a parameter the application already
+    # considers sensitive is sensitive here too, including through Rails'
+    # own nested-hash and Proc handling. Karst then applies one conservative
+    # credential-name net *on top of* that result -- never instead of it --
+    # because an application's filter_parameters is tuned for its own logs
+    # and routinely misses credentials that only appear in a third-party
+    # integration's payload.
+    #
+    # Header handling is deliberately not symmetric with parameter handling:
+    # a credential-bearing header's value is never read, compared, or
+    # echoed. It is replaced by a named placeholder purely on the strength
+    # of its name, so a generated request always tells the engineer which
+    # credential to supply without Karst ever having handled it.
+    #
+    # A URL-shaped header (Referer, Origin) is a third case: its *name* is
+    # not credential-shaped, so the name-based rules above would echo it
+    # verbatim, but its *value* is a URL that can structurally carry a query
+    # string or fragment -- exactly where a password-reset token or an
+    # OAuth access_token tends to live. Those two headers are parsed and
+    # stripped down to scheme/host/path rather than treated as safe or
+    # matched against the credential-name net; see URL_HEADERS.
+    module Sanitizer
+      # ActiveSupport::ParameterFilter's own mask. Rewritten to Karst's
+      # angle-bracket form so a recipe uses one visual convention for
+      # "you must supply this yourself" rather than two.
+      RAILS_MASK = "[FILTERED]"
+      MASK = "<FILTERED>"
+
+      # Headers whose value Karst may echo verbatim: they describe the shape
+      # of the request, never authorize it. An allowlist, so a header Karst
+      # has never considered is handled by the rules below rather than
+      # trusted by default. Deliberately excludes Referer and Origin, even
+      # though both are otherwise request-shape headers -- see URL_HEADERS.
+      SAFE_HEADERS = %w[
+        accept accept-charset accept-encoding accept-language cache-control
+        content-length content-type host if-match if-none-match
+        user-agent x-request-id x-requested-with
+      ].freeze
+
+      # Headers that are themselves URLs, so their name alone cannot make
+      # them safe to echo verbatim: a Referer routinely carries the query
+      # string (and, for an OAuth-style redirect, the fragment) of whatever
+      # page linked here, and either can hold a token, code, or other
+      # credential a request-shape header has no business exposing.
+      # #sanitized_url_header keeps only what identifies the origin/path --
+      # never a value comparison, just discarding the URL components that
+      # are structurally capable of carrying a secret. Origin is included
+      # for the same reason even though the header's own semantics never
+      # define a query, fragment, or userinfo component: Karst's headers
+      # are caller-supplied strings, not values the HTTP client validated
+      # against that grammar.
+      URL_HEADERS = %w[referer origin].freeze
+
+      # Named placeholders for the headers a Rails application actually
+      # authenticates with. The placeholder is chosen from the header name
+      # alone; the real value is never inspected.
+      CREDENTIAL_HEADERS = {
+        "authorization" => "<AUTH_TOKEN>",
+        "proxy-authorization" => "<AUTH_TOKEN>",
+        "www-authenticate" => "<AUTH_TOKEN>",
+        "cookie" => "<SESSION_COOKIE>",
+        "set-cookie" => "<SESSION_COOKIE>",
+        "api-key" => "<API_KEY>",
+        "x-api-key" => "<API_KEY>",
+        "x-auth-token" => "<AUTH_TOKEN>",
+        "x-access-token" => "<AUTH_TOKEN>",
+        "x-csrf-token" => "<CSRF_TOKEN>",
+        "x-xsrf-token" => "<CSRF_TOKEN>"
+      }.freeze
+
+      # Karst's supplementary net, applied after the application's own
+      # filter_parameters. Deliberately credential-shaped rather than a
+      # general PII list (Karst::Access::SensitiveAttributeNames already
+      # owns that, for a different job): a QA recipe is useless if every
+      # ordinary business field is masked, but it is dangerous if one
+      # credential is not.
+      CREDENTIAL_TOKENS = %w[
+        auth authorization bearer certificate cookie credential credentials
+        csrf cvv hmac jwt key nonce otp passphrase password passwd pin pwd
+        salt secret session sig signature ssn token xsrf
+      ].freeze
+
+      # Matched as substrings too, so a run-together name ("apikey",
+      # "accesstoken") is caught even though tokenizing cannot split it.
+      CREDENTIAL_SUBSTRINGS = %w[password secret token apikey credential signature].freeze
+
+      class << self
+        # A deep-filtered copy of any params-like Hash, with String keys.
+        #
+        # `filters` is the filter_parameters of the application whose request
+        # is being reproduced. Karst::Reproduction::Exercise always passes the
+        # application it actually issued the request against, rather than
+        # letting this class reach for Rails.application: those are the same
+        # object in every real application, and reading the global instead
+        # would quietly filter one application's parameters with another
+        # application's rules.
+        def parameters(params, filters: nil)
+          return {} if params.nil?
+
+          supplement(rails_filter(filters).filter(stringify(params)))
+        end
+
+        # name => value-or-placeholder, with canonical header casing.
+        def headers(pairs)
+          (pairs || {}).each_with_object({}) do |(name, value), result|
+            result[canonical(name)] = header_value(name, value)
+          end
+        end
+
+        # True when a sanitized value is a placeholder rather than something
+        # Karst actually observed. Callers use this to keep "redacted" and
+        # "observed" visibly distinct instead of blurring them together.
+        def masked?(value)
+          value.is_a?(String) && value.start_with?("<") && value.end_with?(">")
+        end
+
+        def credential_name?(name)
+          normalized = name.to_s.downcase
+          return true if CREDENTIAL_SUBSTRINGS.any? { |fragment| normalized.include?(fragment) }
+
+          normalized.split(/[^a-z0-9]+/).any? { |token| CREDENTIAL_TOKENS.include?(token) }
+        end
+
+        private
+
+        def header_value(name, value)
+          key = name.to_s.downcase.tr("_", "-")
+          return sanitized_url_header(value) if URL_HEADERS.include?(key)
+          return value.to_s if SAFE_HEADERS.include?(key)
+
+          placeholder = CREDENTIAL_HEADERS[key]
+          return placeholder if placeholder
+          return MASK if credential_name?(key)
+
+          value.to_s
+        end
+
+        # Structural, not value-based: parses the header as a URL and drops
+        # every component capable of carrying a credential (userinfo, query,
+        # fragment), keeping only scheme/host/path so the request context
+        # ("this came from the password-reset page") survives without the
+        # secrets a query or fragment on that URL might hold. A value Karst
+        # cannot parse as a URL at all is masked outright rather than echoed
+        # -- there is no structure left to trust it by.
+        def sanitized_url_header(value)
+          uri = URI.parse(value.to_s)
+          uri.user = nil
+          uri.password = nil
+          uri.query = nil
+          uri.fragment = nil
+          uri.to_s
+        rescue StandardError
+          MASK
+        end
+
+        def canonical(name)
+          name.to_s.downcase.tr("_", "-").split("-").map(&:capitalize).join("-")
+        end
+
+        # Rebuilt per call rather than memoized: a spec (and a reloading
+        # development application) can change filter_parameters between
+        # requests, and a stale filter here would silently stop masking
+        # something the application now considers sensitive.
+        def rails_filter(filters)
+          ActiveSupport::ParameterFilter.new(Array(filters || rails_filter_parameters))
+        end
+
+        def rails_filter_parameters
+          return [] unless defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+
+          Array(Rails.application.config.filter_parameters)
+        rescue StandardError
+          []
+        end
+
+        def stringify(value)
+          case value
+          when Hash then value.each_with_object({}) { |(key, item), result| result[key.to_s] = stringify(item) }
+          when Array then value.map { |item| stringify(item) }
+          else value
+          end
+        end
+
+        def supplement(value)
+          case value
+          when Hash
+            value.each_with_object({}) do |(key, item), result|
+              result[key] = credential_name?(key) ? MASK : supplement(item)
+            end
+          when Array then value.map { |item| supplement(item) }
+          when RAILS_MASK then MASK
+          else value
+          end
+        end
+      end
+    end
+  end
+end

data/lib/karst/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Karst
-  VERSION = "0.2.0"
+  VERSION = "0.4.0"
 end