restore-redact 1.0.0

package/index.js

@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = require('./restore-redact');

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "restore-redact",
+  "version": "1.0.0",
+  "description": "Detect and tokenise secrets in objects/strings, then restore original values on demand",
+  "main": "index.js",
+  "exports": {
+    ".": "./index.js"
+  },
+  "files": [
+    "index.js",
+    "restore-redact.js"
+  ],
+  "scripts": {
+    "test": "jest"
+  },
+  "keywords": [
+    "secrets",
+    "redact",
+    "detect",
+    "restore",
+    "leakguard"
+  ],
+  "author": "",
+  "license": "ISC",
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@leakguard/guard": "^3.0.2"
+  },
+  "devDependencies": {
+    "jest": "^30.4.2"
+  }
+}

package/restore-redact.js

@@ -0,0 +1,85 @@
+'use strict';
+
+const { randomUUID } = require('crypto');
+const { CoreSecretDetector, ContentRedactor } = require('@leakguard/guard');
+
+const store = new Map();
+const detector = new CoreSecretDetector();
+
+const TOKEN_RE = /\[REDACTED:([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\]/g;
+
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function replaceValues(data, valueToToken) {
+  if (typeof data === 'string') {
+    let result = data;
+    for (const [value, token] of valueToToken) {
+      result = result.replace(new RegExp(escapeRegex(value), 'g'), token);
+    }
+    return result;
+  }
+  if (Array.isArray(data)) {
+    return data.map(item => replaceValues(item, valueToToken));
+  }
+  if (data !== null && typeof data === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(data)) {
+      out[k] = replaceValues(v, valueToToken);
+    }
+    return out;
+  }
+  return data;
+}
+
+function restoreValues(data) {
+  if (typeof data === 'string') {
+    return data.replace(TOKEN_RE, (_, id) => store.has(id) ? store.get(id) : `[REDACTED:${id}]`);
+  }
+  if (Array.isArray(data)) {
+    return data.map(item => restoreValues(item));
+  }
+  if (data !== null && typeof data === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(data)) {
+      out[k] = restoreValues(v);
+    }
+    return out;
+  }
+  return data;
+}
+
+function detect(data) {
+  const detection = detector.detect(data);
+
+  if (!detection.hasSecrets) {
+    return data;
+  }
+
+  const valueToToken = new Map();
+  for (const secret of detection.detectedSecrets) {
+    if (!valueToToken.has(secret.value)) {
+      const id = randomUUID();
+      store.set(id, secret.value);
+      valueToToken.set(secret.value, `[REDACTED:${id}]`);
+    }
+  }
+
+  const redactor = new ContentRedactor({
+    customRedactor: (content) => replaceValues(content, valueToToken),
+  });
+
+  const { redacted } = redactor.redactContent(data, detection);
+  return redacted;
+}
+
+function restore(redactedData) {
+  return restoreValues(redactedData);
+}
+
+function clear() {
+  store.clear();
+}
+
+module.exports = { detect, restore, clear };