@voxgig/sdkgen 4.32.1 → 4.34.0

package/project/.sdk/tm/rb/utility/clean.rb

@@ -1,4 +1,315 @@
 # ProjectName SDK utility: clean
+require 'json'
+require 'set'
+require_relative '../schema'
+require_relative '../core/error'
+require_relative 'struct/voxgig_struct'
+
 module ProjectNameUtilities
-  Clean = ->(ctx, val) { val }
+  # Everything that leaves the pipeline passes through clean: the error, the
+  # explain record, the serialised context, and whatever a feature emits.
+  # Two layers: every registered secret VALUE (and its encoded forms) is
+  # replaced wherever it appears in a string, and every value under a
+  # sensitive KEY name is masked whatever it holds. Inside the pipeline data
+  # stays raw, so a hook can still read the header it must add to.
+  module CleanSupport
+    MAXDEPTH = 32
+    CIRCULAR = "[circular]"
+
+    # Marks a value the copy must omit (a Proc), as ts omits `undefined`.
+    DROP = Object.new.freeze
+
+    def self.normkey(key)
+      key.to_s.downcase.gsub(/[-_]/, "")
+    end
+
+    def self.splitkeys(keys)
+      (keys.nil? ? "" : keys.to_s).split(/\s*,\s*/).map { |k| normkey(k) }.reject(&:empty?)
+    end
+
+    # The comma-separated literal values a caller registers; a list is taken
+    # as-is for a caller that has one.
+    def self.splitvalues(values)
+      return values.select { |v| v.is_a?(String) } if values.is_a?(Array)
+      (values.nil? ? "" : values.to_s).split(/\s*,\s*/).reject(&:empty?)
+    end
+
+    # The spec carries numbers as strings, so every target reads it alike.
+    def self.count(val, dflt)
+      n = Float(val.to_s, exception: false)
+      n.nil? || n.nan? || n.infinite? || n < 0 ? dflt : n.floor
+    end
+
+    # The derived block make_options builds; a context without options
+    # (make_error is reached with a bare one) falls back to the schema
+    # defaults, so nothing leaves raw for want of a constructor. A Hash
+    # stands in for a context before one exists (make_options).
+    def self.config(ctx)
+      opts = ctx.respond_to?(:options) ? ctx.options : (ctx.is_a?(Hash) ? ctx["options"] : nil)
+      derived = opts.is_a?(Hash) ? VoxgigStruct.getpath(opts, "__derived__.clean") : nil
+      return derived if derived.is_a?(Hash)
+      make_config(ProjectNameSchema::OPTSPEC["clean"])
+    end
+
+    def self.make_config(cleanopts)
+      opts = cleanopts.is_a?(Hash) ? cleanopts : {}
+      {
+        "active" => opts["active"] != false,
+        "keys" => splitkeys(opts["keys"]),
+        "values" => [],
+        "mask" => opts["mask"].is_a?(String) ? opts["mask"] : "[redacted]",
+        "hint" => count(opts["hint"], 0),
+        "min" => [1, count(opts["min"], 4)].max,
+      }
+    end
+
+    # encodeURIComponent, byte for byte: the form a query credential travels in.
+    def self.pct(value)
+      value.gsub(/[^A-Za-z0-9\-_.!~*'()]/) { |c| c.bytes.map { |b| format("%%%02X", b) }.join }
+    end
+
+    # The encoded forms a value travels in: Basic and Bearer both carry
+    # base64, a query credential is percent-encoded, and a JSON dump escapes it.
+    def self.forms(value)
+      out = [value]
+      add = ->(s) { out << s unless s.empty? || out.include?(s) }
+      add.call([value].pack("m0"))
+      add.call(pct(value))
+      begin
+        add.call(JSON.generate(value)[1..-2])
+      rescue StandardError
+        nil
+      end
+      out
+    end
+
+    # Register a secret value. Idempotent; shorter than `min` is not a secret
+    # the SDK can mask without blanking ordinary text.
+    def self.add(ctx, value)
+      cfg = config(ctx)
+      return unless value.is_a?(String) && value.length >= cfg["min"]
+      values = cfg["values"]
+      changed = false
+      forms(value).each do |form|
+        next if form.length < cfg["min"] || values.include?(form)
+        values << form
+        changed = true
+      end
+      values.sort_by! { |v| -v.length } if changed
+      nil
+    end
+
+    def self.mask_value(cfg, value)
+      hint = cfg["hint"]
+      return cfg["mask"] + value[-hint..] if hint > 0 && value.length > 2 * hint
+      cfg["mask"]
+    end
+
+    def self.clean_string(cfg, text)
+      out = text
+      cfg["values"].each do |value|
+        next unless out.include?(value)
+        masked = mask_value(cfg, value)
+        out = out.gsub(value) { masked }
+      end
+      out
+    end
+
+    def self.sensitive_key?(cfg, key)
+      return false if key.nil? || key.is_a?(Integer)
+      nk = normkey(key)
+      cfg["keys"].any? { |k| nk.include?(k) }
+    end
+
+    # A plain-data copy of what is about to leave: `to_h` is honoured (an
+    # entity gives its data, a context its record), procs are dropped,
+    # cycles are cut, and no live object is shared with the copy - masking
+    # the copy must never mask the pipeline's own spec. An object without a
+    # `to_h` copies as its instance variables, an exception as its message
+    # and fields; its `ctx` is the one field never copied, as the context
+    # holds the error that holds the context.
+    def self.snapshot(cfg, val, key, depth, seen)
+      return val if val.nil?
+
+      if val.is_a?(String)
+        return sensitive_key?(cfg, key) ? mask_value(cfg, val) : clean_string(cfg, val)
+      end
+
+      return DROP if val.is_a?(Proc) || val.is_a?(Method)
+
+      if val.is_a?(Numeric) || val == true || val == false || val.is_a?(Symbol)
+        return sensitive_key?(cfg, key) ? cfg["mask"] : val
+      end
+
+      return CIRCULAR if depth >= MAXDEPTH || seen.any? { |s| s.equal?(val) }
+
+      return cfg["mask"] if sensitive_key?(cfg, key)
+
+      seen.push(val)
+      begin
+        if val.is_a?(Array)
+          out = []
+          val.each_with_index do |item, i|
+            v = snapshot(cfg, item, i, depth + 1, seen)
+            out << v unless v.equal?(DROP)
+          end
+          return out
+        end
+
+        return plain(cfg, val, depth, seen) if val.is_a?(Hash)
+
+        if val.is_a?(Exception)
+          out = { "message" => clean_string(cfg, val.message.to_s) }
+          val.instance_variables.each do |ivar|
+            name = ivar.to_s.delete_prefix("@")
+            next if name == "ctx"
+            v = snapshot(cfg, val.instance_variable_get(ivar), name, depth + 1, seen)
+            out[clean_name(cfg, out, name)] = v unless v.equal?(DROP)
+          end
+          return out
+        end
+
+        if val.is_a?(Struct) || (val.respond_to?(:to_h) && !val.is_a?(Enumerable))
+          begin
+            return snapshot(cfg, val.to_h, key, depth + 1, seen)
+          rescue StandardError
+            nil
+          end
+        end
+
+        return snapshot(cfg, val.to_a, key, depth + 1, seen) if val.is_a?(Set)
+
+        ivars(cfg, val, depth, seen)
+      ensure
+        seen.pop
+      end
+    end
+
+    def self.plain(cfg, val, depth, seen)
+      out = {}
+      val.each do |k, v|
+        c = snapshot(cfg, v, k, depth + 1, seen)
+        out[clean_name(cfg, out, k)] = c unless c.equal?(DROP)
+      end
+      out
+    end
+
+    def self.ivars(cfg, val, depth, seen)
+      out = {}
+      val.instance_variables.each do |ivar|
+        name = ivar.to_s.delete_prefix("@")
+        c = snapshot(cfg, val.instance_variable_get(ivar), name, depth + 1, seen)
+        out[clean_name(cfg, out, name)] = c unless c.equal?(DROP)
+      end
+      out
+    end
+
+    # A registered value used as a property name is masked like any other
+    # string; names that mask alike take a counter, so none is lost.
+    def self.clean_name(cfg, out, key)
+      return key unless key.is_a?(String)
+      name = clean_string(cfg, key)
+      return name if name == key || !out.key?(name)
+      i = 1
+      i += 1 while out.key?("#{name}##{i}")
+      "#{name}##{i}"
+    end
+
+    # Does any message along the cause chain hold a registered value?
+    def self.dirty_chain?(cfg, err)
+      seen = []
+      until err.nil? || seen.any? { |s| s.equal?(err) }
+        return true if clean_string(cfg, err.message.to_s) != err.message.to_s
+        seen << err
+        err = err.cause
+      end
+      false
+    end
+
+    # Clean a value on its way out. A string is redacted; an SDK error is
+    # redacted IN PLACE (it is about to be raised, and its identity matters
+    # to the caller); another exception's message cannot be rewritten, so a
+    # changed one comes back as the same class carrying the cleaned text;
+    # anything else comes back as a masked plain-data copy.
+    def self.clean(ctx, val)
+      cfg = config(ctx)
+
+      return val if cfg["active"] == false
+
+      return clean_string(cfg, val) if val.is_a?(String)
+
+      if val.is_a?(Exception)
+        if val.is_a?(ProjectNameError)
+          val.msg = clean_string(cfg, val.msg.to_s)
+          val.instance_variables.each do |ivar|
+            name = ivar.to_s.delete_prefix("@")
+            next if name == "ctx" || name == "msg"
+            v = val.instance_variable_get(ivar)
+            if v.is_a?(String)
+              val.instance_variable_set(ivar,
+                sensitive_key?(cfg, name) ? mask_value(cfg, v) : clean_string(cfg, v))
+            elsif !v.nil? && !v.is_a?(Numeric) && v != true && v != false
+              val.instance_variable_set(ivar, snapshot(cfg, v, name, 1, []))
+            end
+          end
+          return val
+        end
+
+        # full_message prints the cause chain, so a dirty cause is dropped:
+        # a fresh exception carries none until it is raised.
+        return val unless dirty_chain?(cfg, val)
+        msg = clean_string(cfg, val.message.to_s)
+        out = val.class.exception(msg)
+        out.set_backtrace(val.backtrace) if val.backtrace
+        return out
+      end
+
+      out = snapshot(cfg, val, nil, 0, [])
+      out.equal?(DROP) ? nil : out
+    end
+
+    # Every scalar under a sensitive name, at any depth and of any shape: a
+    # credential mistyped as a map or a number is still a credential, and
+    # the validation error that rejects it quotes it.
+    def self.add_sensitive(ctx, val, under = false, depth = 0, seen = [])
+      return if val.nil? || depth >= MAXDEPTH
+      if val.is_a?(String) || val.is_a?(Integer) || val.is_a?(Float)
+        add(ctx, val.to_s) if under
+        return
+      end
+      return unless val.is_a?(Hash) || val.is_a?(Array)
+      return if seen.any? { |s| s.equal?(val) }
+      seen << val
+      if val.is_a?(Hash)
+        val.each { |k, v| add_sensitive(ctx, v, under || key?(ctx, k), depth + 1, seen) }
+      else
+        val.each { |v| add_sensitive(ctx, v, under, depth + 1, seen) }
+      end
+    end
+
+    # A feature's name is not a field name: only the sensitive names inside
+    # its settings count, so `secrets` does not make every setting a secret.
+    # Entity blocks (per-entity settings, seeded records) hold no credential.
+    def self.add_options(ctx, opts)
+      top = opts.reject { |k, _| k == "feature" || k == "entity" }
+      top["test"] = no_entity(top["test"]) if top.key?("test")
+      add_sensitive(ctx, top)
+      feature = opts["feature"]
+      blocks = feature.is_a?(Hash) ? feature.values : (feature.is_a?(Array) ? feature : [feature])
+      blocks.each { |fopts| add_sensitive(ctx, no_entity(fopts)) }
+    end
+
+    def self.no_entity(block)
+      block.is_a?(Hash) ? block.reject { |k, _| k == "entity" } : block
+    end
+
+    # Is this key name sensitive under the context's clean configuration?
+    def self.key?(ctx, key)
+      sensitive_key?(config(ctx), key)
+    end
+  end
+
+  Clean = ->(ctx, val) { CleanSupport.clean(ctx, val) }
+
+  CleanAdd = ->(ctx, value) { CleanSupport.add(ctx, value) }
 end

package/project/.sdk/tm/rb/utility/done.rb

@@ -1,11 +1,7 @@
 # ProjectName SDK utility: done
 module ProjectNameUtilities
   Done = ->(ctx) {
-    if ctx.ctrl.explain
-      ctx.ctrl.explain = ctx.utility.clean.call(ctx, ctx.ctrl.explain)
-      er = ctx.ctrl.explain["result"]
-      er.delete("err") if er.is_a?(Hash)
-    end
+    CleanExplain.call(ctx)
     if ctx.result && ctx.result.ok
       return ctx.result.resdata
     end
@@ -13,4 +9,18 @@ module ProjectNameUtilities
     # disabled, returns the bare result data). Propagate its value.
     ctx.utility.make_error.call(ctx, nil)
   }
+
+  # The caller's own hash is the explain record (the control is built from
+  # it, and a stream copies only its ctrl), so the cleaned copy is written
+  # back INTO it: assigning a fresh hash would leave the caller holding the
+  # raw one.
+  CleanExplain = ->(ctx) {
+    explain = ctx.ctrl.explain
+    return unless explain.is_a?(Hash)
+    cleaned = ctx.utility.clean.call(ctx, explain)
+    explain.replace(cleaned) if cleaned.is_a?(Hash) && !cleaned.equal?(explain)
+    # With clean off, explain.result is the live result object, not a Hash.
+    er = explain["result"]
+    explain["result"] = er.reject { |k, _| k == "err" } if er.is_a?(Hash)
+  }
 end

package/project/.sdk/tm/rb/utility/make_error.rb

@@ -2,6 +2,7 @@
 require_relative '../core/operation'
 require_relative '../core/result'
 require_relative '../core/error'
+require_relative 'clean'
 module ProjectNameUtilities
   MakeError = ->(ctx, err) {
     if ctx.nil?
@@ -18,9 +19,12 @@ module ProjectNameUtilities
     err = result.err if err.nil?
     err = ctx.make_error("unknown", "unknown error") if err.nil?
 
+    # A bare context (no client, no utility) still cleans, through the
+    # schema defaults.
+    clean = ctx.utility&.clean || ProjectNameUtilities::Clean
+
     errmsg = err.is_a?(ProjectNameError) ? err.msg : err.to_s
-    msg = "ProjectNameSDK: #{opname}: #{errmsg}"
-    msg = ctx.utility.clean.call(ctx, msg)
+    msg = clean.call(ctx, "ProjectNameSDK: #{opname}: #{errmsg}")
 
     result.err = nil
     spec = ctx.spec
@@ -29,15 +33,20 @@ module ProjectNameUtilities
       ctx.ctrl.explain["err"] = { "message" => msg }
     end
 
+    # The context stays reachable for a debugger (`err.ctx`) and is left out
+    # of every serialiser the error defines; result and spec are cleaned
+    # COPIES, so masking them never masks the pipeline's own objects.
     sdk_err = ProjectNameError.new("", msg, ctx)
-    sdk_err.result = ctx.utility.clean.call(ctx, result)
-    sdk_err.spec = ctx.utility.clean.call(ctx, spec)
+    sdk_err.result = clean.call(ctx, result)
+    sdk_err.spec = clean.call(ctx, spec)
 
     # Promote the HTTP status to the top level, so a consumer can branch on
     # `err.status` / `err.not_found?` instead of reaching into `err.result`.
     sdk_err.status = result.status.nil? ? -1 : result.status
     sdk_err.code = err.code if err.is_a?(ProjectNameError)
 
+    clean.call(ctx, sdk_err)
+
     ctx.ctrl.err = sdk_err
 
     # Fire PreUnexpected so observability features (metrics, telemetry, audit,

package/project/.sdk/tm/rb/utility/make_options.rb

@@ -1,9 +1,11 @@
 # ProjectName SDK utility: make_options
 require_relative 'struct/voxgig_struct'
 require_relative '../schema'
+require_relative 'clean'
 module ProjectNameUtilities
   MakeOptions = ->(ctx) {
     options = ctx.options || {}
+    options = {} unless options.is_a?(Hash)
 
     # Merge custom utility overrides.
     #
@@ -58,6 +60,22 @@ module ProjectNameUtilities
 
     opts.delete('auth') if authsuppressed
 
+    config = ctx.config || {}
+    cfgopts = config["options"].is_a?(Hash) ? config["options"] : {}
+
+    # The secret registry exists BEFORE validation, fed from the raw input, so
+    # the constructor's own rejection of a mistyped credential is clean too.
+    cfgclean = cfgopts["clean"].is_a?(Hash) ? VoxgigStruct.clone(cfgopts["clean"]) : nil
+    cleancfg = CleanSupport.make_config(VoxgigStruct.merge(
+      [{}, ProjectNameSchema::OPTSPEC["clean"], cfgclean, opts["clean"]].select { |c| c.is_a?(Hash) }))
+    cleanctx = { "options" => { "__derived__" => { "clean" => cleancfg } } }
+    CleanSupport.add_options(cleanctx, opts.reject { |k, _| k == "clean" })
+    [cfgopts, opts].each do |block|
+      CleanSupport.splitvalues(VoxgigStruct.getpath(block, "clean.values")).each do |raw|
+        CleanSupport.add(cleanctx, raw)
+      end
+    end
+
     # Feature add-order. options["feature"] may be given as an ordered ARRAY of
     # { "name" => ..., "active" => ..., ... } entries (the array position IS the
     # order in which features are added), or as a { "name" => {opts} } map.
@@ -78,9 +96,6 @@ module ProjectNameUtilities
       opts["feature"] = fmap
     end
 
-    config = ctx.config || {}
-    cfgopts = config["options"].is_a?(Hash) ? config["options"] : {}
-
     # THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
     #
     # `ProjectNameSchema::OPTSPEC` is built from the model:
@@ -103,7 +118,12 @@ module ProjectNameUtilities
     # nested hashes as merge TARGETS — one instance's options (server,
     # headers, ...) would contaminate every instance constructed after it.
     merged = VoxgigStruct.merge([{}, VoxgigStruct.clone(cfgopts), opts])
-    validated = VoxgigStruct.validate(merged, optspec)
+    begin
+      validated = VoxgigStruct.validate(merged, optspec)
+    rescue StandardError => e
+      # Not a cause: the raw error would print beneath the cleaned one.
+      raise CleanSupport.clean(cleanctx, e), cause: nil
+    end
     opts = validated.is_a?(Hash) ? validated : {}
 
     # Restore the suppression the optspec default would otherwise erase.
@@ -146,11 +166,6 @@ module ProjectNameUtilities
       opts["system"]["fetch"] = sys_fetch
     end
 
-    clean_keys = VoxgigStruct.getpath(opts, "clean.keys")
-    clean_keys = "key,token,id" unless clean_keys.is_a?(String)
-    parts = clean_keys.split(",").map(&:strip).reject(&:empty?).map { |p| VoxgigStruct.escre(p) }
-    keyre = parts.join("|")
-
     # Resolve the feature add-order: an explicit array order (above) wins;
     # otherwise order the map test-first, then the remaining names sorted, so
     # the outcome is deterministic and `test` is always the base transport.
@@ -176,9 +191,13 @@ module ProjectNameUtilities
       end
     end
 
-    derived = { "clean" => keyre.empty? ? {} : { "keyre" => keyre } }
-    derived["featureorder"] = featureorder
-    opts["__derived__"] = derived
+    # Again over the merged result: the config's own defaults can carry one.
+    CleanSupport.add_options(cleanctx, opts.reject { |k, _| k == "clean" })
+
+    opts["__derived__"] = {
+      "clean" => cleancfg,
+      "featureorder" => featureorder,
+    }
 
     opts
   }

package/project/.sdk/tm/rb/utility/register.rb

@@ -33,6 +33,8 @@ require_relative 'transform_response'
 
 ProjectNameUtility.registrar = ->(u) {
   u.clean = ProjectNameUtilities::Clean
+  u.clean_add = ProjectNameUtilities::CleanAdd
+  u.clean_explain = ProjectNameUtilities::CleanExplain
   u.done = ProjectNameUtilities::Done
   u.make_error = ProjectNameUtilities::MakeError
   u.feature_add = ProjectNameUtilities::FeatureAdd

package/project/.sdk/tm/rust/core/context.rs

@@ -12,6 +12,7 @@ use crate::core::sdk::ProjectNameSDK;
 use crate::core::spec::Spec;
 use crate::core::types::{Entity, OutVal};
 use crate::core::utility_type::Utility;
+use crate::utility::voxgigstruct as vs;
 use crate::utility::voxgigstruct::Value;
 
 pub type OpMap = Rc<RefCell<HashMap<String, Rc<Operation>>>>;
@@ -279,6 +280,46 @@ impl Context {
         ProjectNameError::new(code, msg)
     }
 
+    /// The context as a record, CLEANED: it leaves the pipeline (a logger, an
+    /// error dump), while the live fields stay raw for the pipeline's own use.
+    pub fn to_value(&self) -> Value {
+        let op = self.op.borrow();
+        let spec = match self.spec.borrow().clone() {
+            Some(s) => s.borrow().to_value(),
+            None => Value::Noval,
+        };
+        let result = match self.result.borrow().clone() {
+            Some(r) => r.borrow().to_value(),
+            None => Value::Noval,
+        };
+        let response = match self.response.borrow().clone() {
+            Some(r) => {
+                let r = r.borrow();
+                jo(vec![
+                    ("status", Value::Num(r.status as f64)),
+                    ("statusText", Value::str(r.status_text.clone())),
+                    ("headers", r.headers.clone()),
+                ])
+            }
+            None => Value::Noval,
+        };
+        let record = jo(vec![
+            ("id", Value::str(self.id.clone())),
+            (
+                "op",
+                jo(vec![
+                    ("entity", Value::str(op.entity.clone())),
+                    ("name", Value::str(op.name.clone())),
+                ]),
+            ),
+            ("spec", spec),
+            ("result", result),
+            ("response", response),
+            ("meta", self.meta.borrow().clone()),
+        ]);
+        crate::utility::clean::clean_value(self, &record)
+    }
+
     /// The context utility (set on every pipeline context).
     pub fn util(&self) -> Rc<Utility> {
         self.utility
@@ -309,3 +350,17 @@ impl Context {
         }
     }
 }
+
+// Both prints are the cleaned record: a context is what a hook author hands
+// to a logger.
+impl std::fmt::Debug for Context {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "Context({})", vs::jsonify(&self.to_value(), Some(&vs::JsonFlags { indent: 0, offset: 0 })))
+    }
+}
+
+impl std::fmt::Display for Context {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&vs::jsonify(&self.to_value(), Some(&vs::JsonFlags { indent: 0, offset: 0 })))
+    }
+}

package/project/.sdk/tm/rust/core/utility_type.rs

@@ -56,10 +56,27 @@ impl Utility {
         u::clean::clean_util(ctx, val)
     }
 
+    pub fn clean_str(&self, ctx: &Rc<Context>, val: &str) -> String {
+        u::clean::clean_str(ctx, val)
+    }
+
+    /// Register a secret value the SDK will mask from now on.
+    pub fn clean_add(&self, ctx: &Rc<Context>, value: &str) {
+        u::clean::clean_add(ctx, value)
+    }
+
+    pub fn clean_key(&self, ctx: &Rc<Context>, key: &str) -> bool {
+        u::clean::clean_key(ctx, key)
+    }
+
     pub fn done(&self, ctx: &Rc<Context>) -> Result<Value, ProjectNameError> {
         u::done::done_util(ctx)
     }
 
+    pub fn clean_explain(&self, ctx: &Rc<Context>) {
+        u::done::clean_explain_util(ctx)
+    }
+
     pub fn make_error(
         &self,
         ctx: &Rc<Context>,

package/project/.sdk/tm/rust/feature/audit.rs

@@ -80,6 +80,8 @@ impl AuditFeature {
             setp(&record, "status", Value::Num(r.borrow().status as f64));
         }
 
+        let record = ctx.util().clean(ctx, &record);
+
         self.records.push(record.clone());
         let max = fopt_int(&self.options, "max", 1000) as usize;
         while self.records.len() > max {

package/project/.sdk/tm/rust/feature/cost.rs

@@ -302,10 +302,11 @@ fn commit(
         setp(&record, "currency", Value::str(t.currency.clone()));
         setp(&record, "source", Value::str(source));
         setp(&record, "attempts", Value::Num(attempts));
-
-        t.last = record.clone();
     }
 
+    let record = ctx.util().clean(ctx, &record);
+    track.borrow_mut().last = record.clone();
+
     let sink = getp(options, "sink");
     if let Value::Func(_) = sink {
         call_vfn(&sink, &record);

package/project/.sdk/tm/rust/feature/debug.rs

@@ -9,16 +9,6 @@ use crate::utility::voxgigstruct::Value;
 
 const DEBUG_ENTRY_KEY: &str = "debug_entry";
 
-const DEBUG_DEFAULT_REDACT: [&str; 7] = [
-    "authorization",
-    "cookie",
-    "set-cookie",
-    "api-key",
-    "apikey",
-    "x-api-key",
-    "idempotency-key",
-];
-
 pub struct DebugFeature {
     pub name: String,
     pub active: bool,
@@ -40,21 +30,26 @@ impl DebugFeature {
         }
     }
 
-    fn redact(&self, headers: &Value) -> Value {
+    // The core clean rules apply (clean.keys, every registered value); the
+    // feature's own `redact` list ADDS header names on top of them.
+    fn redact(&self, ctx: &Rc<Context>, headers: &Value) -> Value {
         let out = Value::empty_map();
-        let patterns = fopt_str_list(&self.options, "redact")
-            .unwrap_or_else(|| DEBUG_DEFAULT_REDACT.iter().map(|s| s.to_string()).collect());
+        let patterns: Vec<String> = fopt_str_list(&self.options, "redact")
+            .unwrap_or_default()
+            .iter()
+            .map(|p| p.to_lowercase())
+            .collect();
         if let Value::Map(m) = headers {
             for (k, v) in m.borrow().iter() {
                 let masked = patterns.iter().any(|p| k.to_lowercase() == *p);
                 if masked {
-                    setp(&out, k, Value::str("<redacted>"));
+                    setp(&out, k, Value::str("[redacted]"));
                 } else {
                     setp(&out, k, v.clone());
                 }
             }
         }
-        out
+        ctx.util().clean(ctx, &out)
     }
 
     fn finish(&mut self, ctx: &Rc<Context>, ok: bool) {
@@ -78,6 +73,11 @@ impl DebugFeature {
             }
         }
 
+        // The whole entry leaves through the buffer and the callback: the url
+        // and the error message can carry a query credential the header mask
+        // above never saw.
+        let entry = ctx.util().clean(ctx, &entry);
+
         self.entries.push(entry.clone());
         let max = fopt_int(&self.options, "max", 100) as usize;
         while self.entries.len() > max {
@@ -132,7 +132,7 @@ impl Feature for DebugFeature {
             } else {
                 setp(&entry, "url", Value::str(s.path.clone()));
             }
-            setp(&entry, "headers", self.redact(&s.headers));
+            setp(&entry, "headers", self.redact(ctx, &s.headers));
         }
         ctx.out_set(DEBUG_ENTRY_KEY, OutVal::Val(entry));
     }