@bli-cockpit/cli 0.2.28 → 0.2.29

package/dist/adapters/raw-evidence-sanitize.js

@@ -0,0 +1,190 @@
+import { containsSecretLikeContent, redactSecretLikeContent, } from "@bli-cockpit/telemetry-core";
+import { sha256 } from "./raw-evidence-keys.js";
+export function sanitizeTextEvidenceForUpload(options) {
+    const originalBytes = options.originalBytes ?? Buffer.from(options.text, "utf8");
+    // Deliberately outside the try: the content guard is the cheap check that
+    // decides which masking strategy applies, and it is not the thing whose
+    // crash the stub below is for.
+    const secretLikeContent = containsSecretLikeContent(options.text);
+    try {
+        const redactionResult = (options.redact ?? redactSecretLikeContent)(options.text, {
+            appliedBy: "local_collector",
+            redactedFields: options.redactedFields,
+        });
+        if (options.secretLikeFileName) {
+            return maskFileWithSecretLikeName({
+                text: options.text,
+                originalBytes,
+                redactedFields: options.redactedFields,
+                redactionResult,
+            });
+        }
+        if (secretLikeContent) {
+            return maskSecretBearingLinesOnly({
+                text: options.text,
+                originalBytes,
+                redactedFields: options.redactedFields,
+                redactionResult,
+            });
+        }
+        if (redactionResult.redacted) {
+            return keepDeterministicRedaction({
+                text: options.text,
+                originalBytes,
+                redactedFields: options.redactedFields,
+                redactionResult,
+            });
+        }
+        return { status: "clean", bytes: originalBytes };
+    }
+    catch {
+        return stubForCrashedRedaction({
+            text: options.text,
+            originalBytes,
+            redactedFields: options.redactedFields,
+        });
+    }
+}
+/**
+ * The name itself (`.env.production`, `id_rsa`) is the signal, so nothing in
+ * this file is trusted: whatever the redactor left behind is re-checked, and a
+ * still-secret-looking result is replaced wholesale by one marker line.
+ */
+function maskFileWithSecretLikeName(input) {
+    const sanitizedText = input.redactionResult.redacted
+        ? input.redactionResult.text
+        : input.text;
+    const safeText = containsSecretLikeContent(sanitizedText)
+        ? "[REDACTED_LINE:secret_redaction_failed]\n"
+        : sanitizedText;
+    const sanitizedBytes = Buffer.from(safeText, "utf8");
+    return {
+        status: "redacted",
+        bytes: sanitizedBytes,
+        redaction: withRedactionContentMetadata(input.redactionResult.metadata ??
+            fallbackRedactionMetadata({
+                ruleId: "secret_like_file_name",
+                originalText: input.text,
+                redactedFields: input.redactedFields,
+                fullContentRedacted: false,
+            }), { originalBytes: input.originalBytes, sanitizedBytes }),
+        completenessLabel: "secret_like_name_masked",
+    };
+}
+/** Only the lines that matched are replaced; every other line uploads intact. */
+function maskSecretBearingLinesOnly(input) {
+    const redaction = input.redactionResult.metadata ??
+        fallbackRedactionMetadata({
+            ruleId: "secret_like_content_guard",
+            originalText: input.text,
+            redactedFields: input.redactedFields,
+        });
+    let maskedText = maskSecretBearingLines(input.text, redaction);
+    if (containsSecretLikeContent(maskedText)) {
+        maskedText = "[REDACTED_LINE:secret_redaction_failed]\n";
+    }
+    const sanitizedBytes = Buffer.from(maskedText, "utf8");
+    return {
+        status: "redacted",
+        bytes: sanitizedBytes,
+        redaction: withRedactionContentMetadata(redaction, {
+            originalBytes: input.originalBytes,
+            sanitizedBytes,
+        }),
+        completenessLabel: "secret_content_masked",
+    };
+}
+/** The redactor found and replaced something the content guard did not flag. */
+function keepDeterministicRedaction(input) {
+    const sanitizedBytes = Buffer.from(input.redactionResult.text, "utf8");
+    return {
+        status: "redacted",
+        bytes: sanitizedBytes,
+        redaction: withRedactionContentMetadata(input.redactionResult.metadata ??
+            fallbackRedactionMetadata({
+                ruleId: "secret_redaction_failed",
+                originalText: input.text,
+                redactedFields: input.redactedFields,
+            }), { originalBytes: input.originalBytes, sanitizedBytes }),
+        completenessLabel: "secret_content_masked",
+    };
+}
+function stubForCrashedRedaction(input) {
+    const sanitizedBytes = Buffer.from("[REDACTED_LINE:redaction_crashed_stubbed]\n", "utf8");
+    return {
+        status: "redacted",
+        bytes: sanitizedBytes,
+        redaction: withRedactionContentMetadata(fallbackRedactionMetadata({
+            ruleId: "redaction_crashed_stubbed",
+            originalText: input.text,
+            redactedFields: input.redactedFields,
+        }), { originalBytes: input.originalBytes, sanitizedBytes }),
+        completenessLabel: "redaction_crashed_stubbed",
+    };
+}
+function maskSecretBearingLines(text, redaction) {
+    if (redaction.redacted_ranges.length === 0) {
+        return "[REDACTED_LINE:secret_like_content_guard]\n";
+    }
+    const segments = text.match(/[^\n]*(?:\n|$)/gu)?.filter(Boolean) ?? [];
+    let offset = 0;
+    return segments
+        .map((segment) => {
+        const start = offset;
+        const end = offset + segment.length;
+        offset = end;
+        const matched = redaction.redacted_ranges.find((range) => range.start < end && start < range.end);
+        if (!matched)
+            return segment;
+        return `[REDACTED_LINE:${matched.rule_id}]${lineEndingOf(segment)}`;
+    })
+        .join("");
+}
+function lineEndingOf(segment) {
+    if (segment.endsWith("\r\n"))
+        return "\r\n";
+    if (segment.endsWith("\n"))
+        return "\n";
+    return "";
+}
+function fallbackRedactionMetadata(options) {
+    const fullContentRedacted = options.fullContentRedacted !== false;
+    return {
+        schema_version: "raw-evidence-redaction.v1",
+        status: "sanitized",
+        mode: "deterministic_text_replacement",
+        applied_by: ["local_collector"],
+        rule_counts: [
+            {
+                rule_id: options.ruleId,
+                match_count: 1,
+                redacted_char_count: fullContentRedacted
+                    ? options.originalText.length
+                    : 0,
+            },
+        ],
+        secret_like_match_count: 1,
+        redacted_fields: options.redactedFields,
+        redacted_ranges: fullContentRedacted && options.originalText.length > 0
+            ? [
+                {
+                    start: 0,
+                    end: options.originalText.length,
+                    rule_id: options.ruleId,
+                },
+            ]
+            : [],
+    };
+}
+function withRedactionContentMetadata(metadata, options) {
+    if (!metadata) {
+        throw new Error("redacted evidence is missing redaction metadata");
+    }
+    return {
+        ...metadata,
+        original_content_hash_sha256: sha256(options.originalBytes),
+        sanitized_content_hash_sha256: sha256(options.sanitizedBytes),
+        original_byte_size: options.originalBytes.byteLength,
+        sanitized_byte_size: options.sanitizedBytes.byteLength,
+    };
+}