logmask 0.1.3__py3-none-any.whl

logmask/__init__.py

@@ -0,0 +1,18 @@
+from .config import masked_config
+from .configure import setup_logging
+from .excepthook import install_excepthook
+from .formatter import JsonFormatter
+from .handler import SafeStreamHandler
+from .secrets import MASKED_VALUE, SecretsMasker
+from .structlog_processor import mask_secrets_processor
+
+__all__ = (
+    'MASKED_VALUE',
+    'JsonFormatter',
+    'SafeStreamHandler',
+    'SecretsMasker',
+    'install_excepthook',
+    'mask_secrets_processor',
+    'masked_config',
+    'setup_logging',
+)

logmask/config.py

@@ -0,0 +1,29 @@
+from collections.abc import Mapping
+from typing import Any
+
+from .secrets import MASKED_VALUE, check_private_value
+
+
+def masked_config(public: Mapping[str, Any], private: Mapping[str, Any]) -> dict[str, Any]:
+    """The config for the startup log: public values as they are, private values replaced by the placeholder.
+
+    A private list keeps its length, and an unset private value (None or an empty string) becomes an empty string, so
+    the log shows which variables are set without reading their values. Any other value, `0` and `False` included, is
+    set and shows the placeholder. A variable in both mappings is an error, and so is a private value of a type the
+    masker cannot search for secrets, the same error `setup_logging` raises.
+    """
+    overlap = sorted(set(public) & set(private))
+    if overlap:
+        raise ValueError(f'Variables listed as both public and private: {overlap}')
+    for value in private.values():
+        check_private_value(value)
+
+    return {**public, **{key: _mask(value) for key, value in private.items()}}
+
+
+def _mask(value: Any) -> Any:
+    if value is None or (isinstance(value, str | bytes) and not value):
+        return ''
+    if isinstance(value, list | tuple):
+        return [_mask(item) for item in value]
+    return MASKED_VALUE

logmask/configure.py

@@ -0,0 +1,51 @@
+import logging
+import threading
+from collections.abc import Mapping
+from typing import IO
+
+from .excepthook import install_excepthook
+from .formatter import JsonFormatter
+from .handler import SafeStreamHandler
+from .secrets import SecretsMasker
+
+# One masker per process: a second call adds its secrets to the same masker, so the secrets of the first call stay
+# masked after a library or a test configures logging again.
+_masker: SecretsMasker | None = None
+_lock = threading.Lock()
+
+
+def setup_logging(secrets: Mapping[str, object], *, level: int | str = logging.INFO, stream: IO[str] | None = None) -> SecretsMasker:
+    """Configure the root logger: JSON lines to the stream (stderr by default), every line masked.
+
+    `secrets` is the mapping of private variables; a service that reads its secrets later passes `{}` and calls
+    `add()` on the returned masker. A private value of a type the masker cannot search raises `TypeError`. Existing
+    handlers of the root logger are replaced, the handler of last resort (for a logger that does not propagate and
+    has no handler) is replaced by a masked one, warnings are routed through the logger, and the exception hooks of
+    the main thread, of the other threads and of the unraisable exceptions are installed, so every traceback is
+    masked too. The same masker serves a structlog processor or masks text by hand. `level` is a logging level or its
+    name in any case.
+    """
+    global _masker
+    with _lock:
+        if _masker is None:
+            _masker = SecretsMasker(secrets)
+        else:
+            _masker.add(secrets)
+        masker = _masker
+    if isinstance(level, str):
+        level = level.upper()
+
+    handler = SafeStreamHandler(stream, masker=masker)
+    handler.setFormatter(JsonFormatter(masker))
+    logging.basicConfig(level=level, handlers=[handler], force=True)
+    # A logger with propagate=False and no handler of its own goes to logging.lastResort, which writes the raw
+    # message to stderr. The replacement writes a masked JSON line to the same stream, at the same level (WARNING).
+    last_resort = SafeStreamHandler(stream, masker=masker)
+    last_resort.setFormatter(JsonFormatter(masker))
+    last_resort.setLevel(logging.WARNING)
+    logging.lastResort = last_resort
+    # warnings.warn() prints to stderr by default; a warning text may carry a URL.
+    logging.captureWarnings(True)
+
+    install_excepthook(masker=masker)
+    return masker

logmask/excepthook.py

@@ -0,0 +1,102 @@
+# sys.UnraisableHookArgs exists only in the type stubs: the annotations must not be evaluated at runtime.
+from __future__ import annotations
+
+import contextlib
+import logging
+import sys
+import threading
+import traceback
+from types import TracebackType
+
+from .formatter import JsonFormatter
+from .handler import SafeStreamHandler
+from .secrets import LIBRARY_TAG, SecretsMasker
+
+LOGGER_NAME = 'unhandled'
+
+
+def _format(exc_type: type[BaseException], exc_value: BaseException | None, exc_traceback: TracebackType | None) -> str:
+    if exc_value is None:
+        return f'{exc_type.__name__}\n' + ''.join(traceback.format_tb(exc_traceback))
+    return ''.join(traceback.format_exception(exc_type, exc_value, exc_traceback))
+
+
+def _log_exception(
+    exc_type: type[BaseException],
+    exc_value: BaseException | None,
+    exc_traceback: TracebackType | None,
+    *,
+    masker: SecretsMasker,
+    message: str,
+    thread_name: str | None = None,
+    context: str | None = None,
+) -> None:
+    """Send the traceback through the logger, so that it is formatted and masked too.
+
+    A stop by Ctrl-C is not an error: for KeyboardInterrupt the traceback goes to stderr as plain text, like the
+    default hook prints it, but masked. The chained exceptions in it (`__context__`) may carry a URL or a key.
+    The traceback text is masked before it enters the record: a handler that is not the masking one (added by a
+    library after the setup) would otherwise print it raw. When the logger has no handler, the line is written to
+    stderr by this module, masked, instead of the raw record that `logging.lastResort` would print. When anything in
+    here fails, one masked line goes to stderr: the interpreter would otherwise print the hook's error together with
+    the original traceback, unmasked.
+    """
+    try:
+        error = masker.mask(_format(exc_type, exc_value, exc_traceback))
+        if issubclass(exc_type, KeyboardInterrupt):
+            sys.stderr.write(error)
+            return
+
+        record_message: dict[str, object] = {'msg': message, 'error': error}
+        if thread_name is not None:
+            record_message['thread'] = masker.mask(thread_name)
+        if context is not None:
+            record_message['context'] = masker.mask(context)
+
+        logger = logging.getLogger(LOGGER_NAME)
+        if logger.hasHandlers():
+            logger.critical(record_message)
+            return
+        record = logger.makeRecord(logger.name, logging.CRITICAL, '(unknown file)', 0, record_message, (), None)
+        handler = SafeStreamHandler(sys.stderr, masker=masker)
+        handler.setFormatter(JsonFormatter(masker))
+        handler.handle(record)
+    except BaseException as failure:  # noqa: BLE001 - the hook must not raise, see the docstring
+        with contextlib.suppress(Exception):
+            sys.stderr.write(masker.mask(f'--- {LIBRARY_TAG} {exc_type.__name__} could not be logged: {type(failure).__name__} ---\n'))
+
+
+def install_excepthook(*, masker: SecretsMasker) -> None:
+    """Route the unhandled exceptions of the main thread, of the other threads, and the unraisable ones through the logger.
+
+    `masker` covers the output that cannot go through the logger: a KeyboardInterrupt traceback, any exception when
+    no handler is configured, and a failure of the hook itself. The logger's own handler masks the rest.
+    """
+
+    def hook(exc_type: type[BaseException], exc_value: BaseException, exc_traceback: TracebackType | None) -> None:
+        _log_exception(exc_type, exc_value, exc_traceback, masker=masker, message='Unhandled exception. Shut down.')
+
+    def thread_hook(args: threading.ExceptHookArgs) -> None:
+        if issubclass(args.exc_type, SystemExit):
+            # The default thread hook ignores sys.exit() in a thread; so do we.
+            return
+        thread_name = args.thread.name if args.thread is not None else None
+        _log_exception(
+            args.exc_type,
+            args.exc_value,
+            args.exc_traceback,
+            masker=masker,
+            message='Unhandled exception in a thread.',
+            thread_name=thread_name,
+        )
+
+    def unraisable_hook(args: sys.UnraisableHookArgs) -> None:
+        # An exception in __del__, in a weakref callback or in a GC hook: the default hook prints it to stderr.
+        # err_msg says where, when the interpreter sets it (Python 3.14 and later); otherwise the type of the object
+        # stands in. The object itself is not logged, its repr is unknown text.
+        context = args.err_msg or f'Exception ignored in: {type(args.object).__name__}'
+        _log_exception(args.exc_type, args.exc_value, args.exc_traceback, masker=masker, message='Unraisable exception.', context=context)
+
+    sys.excepthook = hook
+    threading.excepthook = thread_hook
+    sys.unraisablehook = unraisable_hook

logmask/formatter.py

@@ -0,0 +1,107 @@
+import dataclasses
+import json
+import logging
+from collections.abc import Callable, Iterator, Mapping
+from typing import Any
+
+from .secrets import LIBRARY_TAG, SecretsMasker
+
+UNPRINTABLE = '<unprintable>'
+
+
+def json_default(value: object) -> Any:
+    """Values json.dumps does not know: bytes as 0x-hex, dataclasses as dicts, sets and iterators as lists, the rest as text."""
+    if isinstance(value, bytes | bytearray):
+        return '0x' + bytes(value).hex()
+    if dataclasses.is_dataclass(value) and not isinstance(value, type):
+        return dataclasses.asdict(value)
+    if isinstance(value, Mapping):
+        return dict(value)
+    if isinstance(value, set | frozenset | Iterator):
+        return list(value)
+    return str(value)
+
+
+def _safe(convert: Callable[[Any], str], value: Any) -> str:
+    try:
+        return convert(value)
+    except Exception:  # noqa: BLE001 - a __str__ or __repr__ that raises must not break the fallback line
+        return UNPRINTABLE
+
+
+class JsonFormatter(logging.Formatter):
+    """One JSON object per line with a fixed set of record fields; every line goes through the masker.
+
+    `format()` never raises: a record that cannot be formatted becomes a line with an `error` field. Otherwise the
+    handler would report the error with the raw message and arguments, without masking, or the error would reach the
+    caller of the logger.
+    """
+
+    def __init__(self, masker: SecretsMasker):
+        super().__init__()
+        self._masker = masker
+
+    def format(self, record: logging.LogRecord) -> str:
+        try:
+            text = json.dumps(self._line(record), default=json_default)
+        except Exception as error:  # noqa: BLE001 - any formatting error must become a masked line, see the class docstring
+            text = json.dumps(self._fallback_line(record, error))
+        # Secrets are hidden in every log line, including messages from third-party libraries.
+        masked = self._masker.mask(text)
+        try:
+            json.loads(masked)
+            return masked
+        except ValueError:
+            pass
+        # A secret made of JSON syntax (a quote, a brace, `true`, a number) was replaced outside the strings. Mask
+        # the strings one by one instead; the JSON-escaped forms are then not needed, and the syntax stays.
+        try:
+            return json.dumps(self._mask_leaves(json.loads(text)))
+        except Exception as error:  # noqa: BLE001 - a message nested too deep for the recursion limit, see the class docstring
+            # The fallback line is flat: its values are the record fields and short texts.
+            return json.dumps(self._mask_leaves(self._fallback_line(record, error)))
+
+    def _mask_leaves(self, value: Any) -> Any:
+        if isinstance(value, str):
+            return self._masker.mask(value)
+        if isinstance(value, dict):
+            return {self._masker.mask(key): self._mask_leaves(item) for key, item in value.items()}
+        if isinstance(value, list):
+            return [self._mask_leaves(item) for item in value]
+        if isinstance(value, int | float) and not isinstance(value, bool):
+            # A number equal to a secret (a PIN, an id) is what broke the line: it is replaced by the masked text.
+            text = str(value)
+            masked = self._masker.mask(text)
+            return value if masked == text else masked
+        return value
+
+    def _base(self, record: logging.LogRecord) -> dict[str, Any]:
+        return {
+            'name': record.name,
+            'levelname': record.levelname,
+            'funcName': record.funcName,
+            'lineno': record.lineno,
+            'module': record.module,
+            'pathname': record.pathname,
+            'timestamp': int(record.created),
+        }
+
+    def _line(self, record: logging.LogRecord) -> dict[str, Any]:
+        message = record.msg if isinstance(record.msg, dict) else {'msg': record.getMessage()}
+        line = self._base(record)
+        for key, value in message.items():
+            # The record fields win: a message key `name` or `timestamp` would break every query on them.
+            line[f'msg_{key}' if key in line else key] = value
+        if record.exc_info:
+            line['exc_info'] = self.formatException(record.exc_info)
+        return line
+
+    def _fallback_line(self, record: logging.LogRecord, error: Exception) -> dict[str, Any]:
+        line = {
+            **self._base(record),
+            'msg': _safe(str, record.msg),
+            'error': f'{LIBRARY_TAG} Log record could not be formatted: {_safe(repr, error)}',
+        }
+        if record.args:
+            line['args'] = _safe(repr, record.args)
+        return line

logmask/handler.py

@@ -0,0 +1,28 @@
+import contextlib
+import logging
+import sys
+from typing import IO
+
+from .secrets import LIBRARY_TAG, SecretsMasker
+
+
+class SafeStreamHandler(logging.StreamHandler):  # type: ignore[type-arg]
+    """A StreamHandler whose error report does not show the record.
+
+    When a handler cannot write a record (a closed stream, a broken pipe), the standard `handleError` prints the raw
+    message and the arguments to stderr, without masking. This handler reports the error and where the record came
+    from, masked, and nothing else from the record.
+    """
+
+    def __init__(self, stream: IO[str] | None = None, *, masker: SecretsMasker):
+        super().__init__(stream)
+        self._masker = masker
+
+    def handleError(self, record: logging.LogRecord) -> None:
+        if not logging.raiseExceptions:
+            return
+        error = sys.exc_info()[1]
+        text = f'--- {LIBRARY_TAG} Logging error: {error!r} (record from {record.name}, {record.pathname}:{record.lineno}) ---\n'
+        # stderr may be the stream that failed; there is nowhere else to report.
+        with contextlib.suppress(Exception):
+            sys.stderr.write(self._masker.mask(text))

logmask/secrets.py

@@ -0,0 +1,302 @@
+import base64
+import dataclasses
+import json
+import numbers
+import os
+import re
+import threading
+from collections.abc import Iterable, Iterator, Mapping
+from urllib.parse import quote, quote_plus, unquote, unquote_plus, urlsplit
+
+MASKED_VALUE = '***'
+# Every line the library writes on its own behalf, instead of the record, starts with this tag.
+LIBRARY_TAG = '[logmask]'
+# Every private value is masked whole, whatever its length. A standalone fragment of a private URL (the host, one
+# path segment, one query value) is masked on its own only when it can be a key: 16 characters or more, or 8 or more
+# with a digit. The whole URL, the whole path, the whole query and the user:password are masked without any
+# condition. Masking a word like `eth`, a segment like `v3` or a host like `el` on its own would erase it from every
+# log line.
+_KEY_FRAGMENT_LENGTH = 16
+_KEY_FRAGMENT_LENGTH_WITH_DIGIT = 8
+# The encodings of a value (percent, base64, hex of its bytes) are derived for values of 4 characters or more: the
+# encodings of a shorter value are short random-looking strings that hit ordinary words. The value itself is always
+# masked.
+_ENCODED_FORMS_MIN_LENGTH = 4
+# How many layers of repr() or json.dumps() around a secret are recognised, on top of the JSON encoding of the line.
+_ESCAPE_DEPTH = 2
+
+_HEX = re.compile(r'(0x)?([0-9a-f]+)', re.ASCII | re.IGNORECASE)
+
+
+def _key_fragment(text: str) -> bool:
+    return len(text) >= _KEY_FRAGMENT_LENGTH or (len(text) >= _KEY_FRAGMENT_LENGTH_WITH_DIGIT and any(char.isdigit() for char in text))
+
+
+def _utf8(text: str) -> bytes:
+    # A value read from the environment may carry bytes that are not UTF-8, as lone surrogates (surrogateescape).
+    return text.encode('utf-8', errors='surrogateescape')
+
+
+def _hex_forms(text: str) -> Iterator[str]:
+    # A hex secret is logged with or without the 0x prefix, and as the bytes it encodes (a private key is held as
+    # bytes by eth_account); the pattern ignores the case.
+    match = _HEX.fullmatch(text)
+    if match is None:
+        return
+    digits = match[2]
+    yield digits
+    yield '0x' + digits
+    if len(digits) % 2 == 0:
+        yield repr(bytes.fromhex(digits))[2:-1]
+
+
+def _encoded_forms(text: str) -> Iterator[str]:
+    """The forms an application gives a raw secret when it builds a URL, a header or a bytes value from it."""
+    if len(text) < _ENCODED_FORMS_MIN_LENGTH:
+        return
+    raw = _utf8(text)
+    yield quote(text, safe='', errors='surrogateescape')
+    yield quote(text, errors='surrogateescape')
+    yield quote_plus(text, errors='surrogateescape')
+    for encoded in (base64.b64encode(raw), base64.urlsafe_b64encode(raw)):
+        yield encoded.decode()
+        yield encoded.decode().rstrip('=')
+    # json_default writes a bytes value as 0x-hex; a text secret inside such a value must be found in that form too.
+    yield raw.hex()
+    yield repr(raw)[2:-1]
+
+
+def _with_decoded(text: str) -> Iterator[str]:
+    yield text
+    yield unquote(text)
+
+
+def _url_parts(text: str) -> Iterator[str]:
+    try:
+        url = urlsplit(text)
+    except ValueError:
+        return
+    if not (url.scheme and url.netloc):
+        return
+
+    # The netloc with the credentials always, and the host alone when a provider may have put the key into it.
+    if '@' in url.netloc:
+        yield url.netloc
+    for host in (url.netloc.rpartition('@')[2], url.hostname or ''):
+        if _key_fragment(host):
+            yield host
+    for part in (url.username, url.password):
+        if part:
+            yield from _with_decoded(part)
+    if url.password:
+        userinfo = f'{url.username or ""}:{url.password}'
+        yield from _with_decoded(userinfo)
+        # The same credentials as an HTTP Basic header.
+        yield base64.b64encode(_utf8(unquote(userinfo))).decode()
+
+    # HTTP libraries log the path, or the path with the query, without the host.
+    if url.path.strip('/'):
+        yield from _with_decoded(url.path)
+        yield url.path.rstrip('/')
+        for segment in url.path.split('/'):
+            if _key_fragment(segment):
+                yield from _with_decoded(segment)
+    if url.query:
+        yield url.query
+        yield f'{url.path}?{url.query}'
+        for pair in url.query.split('&'):
+            yield pair
+            value = pair.partition('=')[2]
+            if _key_fragment(value):
+                yield from _with_decoded(value)
+
+
+def _variants(text: str) -> Iterator[str]:
+    # A secret read from a file usually keeps the trailing newline, the log shows the stripped value.
+    for form in dict.fromkeys((text, text.strip())):
+        yield form
+        yield form.rstrip('/')
+        # A value stored percent-encoded (a password inside a URL) is used decoded by the application.
+        yield unquote(form)
+        yield unquote_plus(form)
+        yield from _hex_forms(form)
+        yield from _url_parts(form)
+        yield from _encoded_forms(form)
+
+
+def _encodings(text: str) -> Iterator[str]:
+    """The body of a string after one layer of repr() or json.dumps()."""
+    # repr() picks the quote style from the whole string: a secret with a ' inside a string that also has a " is
+    # escaped as \'. Both bodies are needed.
+    yield repr(text)[1:-1]
+    yield repr(text + '"')[1:-2]
+    yield json.dumps(text)[1:-1]
+
+
+def _escaped_forms(text: str) -> set[str]:
+    forms = {text}
+    layer = {text}
+    for _ in range(_ESCAPE_DEPTH):
+        layer = {encoded for form in layer for encoded in _encodings(form)}
+        forms |= layer
+    return forms
+
+
+SUPPORTED_TYPES = 'str, bytes, a number, a path, a mapping, a list or another iterable, a dataclass or an object with get_secret_value()'
+
+
+def _strings_inside(text: str, seen: dict[int, object]) -> Iterator[str]:
+    """The values held by one string: a JSON document (a list of URLs, the JSON of a service account) is searched as
+    the container it encodes, several URLs separated by commas, semicolons or white space are searched one by one
+    (otherwise only the last URL would get its parts, the others would be plain prefixes of the value), and every
+    line of a multi-line value (a PEM key) is a secret on its own, as a library prints it line by line."""
+    if text.lstrip()[:1] in ('[', '{'):
+        try:
+            document = json.loads(text)
+        except ValueError:
+            document = None
+        if isinstance(document, list | dict):
+            yield from _strings(document, seen)
+            return
+    urls = [piece for piece in re.split(r'[,;\s]+', text) if '://' in piece]
+    if len(urls) > 1:
+        yield from urls
+    lines = [line.strip() for line in text.splitlines()]
+    if len(lines) > 1:
+        yield from (line for line in lines if line)
+
+
+def _strings(value: object, seen: dict[int, object]) -> Iterator[str]:
+    """Every string inside the value: strings and the values a string holds (a JSON document, a list of URLs), bytes
+    in their text, hex and repr forms, the items of containers and other iterables (the keys of a nested mapping are
+    data, like its values; the keys of the top-level mapping are the variable names and never reach here), the fields
+    of a dataclass, the wrapped value of a SecretStr-like object, numbers and paths as text. None and bool are not
+    secrets. Any other type is refused: the masker cannot promise that it found every secret inside it.
+
+    `seen` keeps a reference to every container visited, so that a cycle stops and a freed temporary cannot hand its
+    id to a later container that would then be skipped.
+    """
+    if value is None or isinstance(value, bool):
+        return
+    if isinstance(value, str):
+        yield value
+        yield from _strings_inside(value, seen)
+    elif isinstance(value, bytes | bytearray | memoryview):
+        raw = bytes(value)
+        yield raw.decode('utf-8', errors='surrogateescape')
+        yield raw.hex()
+        yield repr(raw)[2:-1]
+    elif isinstance(value, numbers.Number | os.PathLike):
+        # Whatever text the value shows in a log is a secret too.
+        yield str(value)
+    elif id(value) in seen:
+        return
+    elif isinstance(value, Mapping):
+        seen[id(value)] = value
+        for key, item in value.items():
+            yield from _strings(key, seen)
+            yield from _strings(item, seen)
+    elif isinstance(value, Iterable):
+        seen[id(value)] = value
+        for item in value:
+            yield from _strings(item, seen)
+    elif callable(getter := getattr(value, 'get_secret_value', None)):
+        # pydantic SecretStr and the like: str() shows a placeholder, the secret is behind the method.
+        seen[id(value)] = value
+        yield from _strings(getter(), seen)
+    elif dataclasses.is_dataclass(value):
+        seen[id(value)] = value
+        for field in dataclasses.fields(value):
+            yield from _strings(getattr(value, field.name), seen)
+    else:
+        raise TypeError(f'A private value of type {type(value).__name__} is not supported, pass {SUPPORTED_TYPES}')
+
+
+def check_private_value(value: object) -> None:
+    """Raise `TypeError` for a value the masker cannot search for secrets, by the rule of `SecretsMasker`."""
+    for _ in _strings(value, {}):
+        pass
+
+
+def _secret_values(secrets: Mapping[str, object]) -> frozenset[str]:
+    """Every string to hide in the formatted log line, derived from the secret values."""
+    forms: set[str] = set()
+    for value in secrets.values():
+        for item in _strings(value, {}):
+            for variant in _variants(item):
+                if variant:
+                    forms |= _escaped_forms(variant)
+    # Every form once more JSON-escaped: the replacement runs on the formatted JSON line.
+    return frozenset(forms | {json.dumps(form)[1:-1] for form in forms})
+
+
+def _compile(forms: Iterable[str], flags: int) -> re.Pattern[str]:
+    # Longest first, so that a value which contains another one is replaced as a whole. The alternation tries the
+    # values in order, and the lookahead makes the search report a match at every position, also inside an earlier
+    # match: overlapping secrets are merged into one span, a plain substitution would leave the tail of the second
+    # one visible.
+    ordered = sorted(set(forms), key=lambda form: (-len(form), form))
+    pattern = re.compile('(?=(' + '|'.join(map(re.escape, ordered)) + '))', flags)
+    # re keeps the last few hundred compiled patterns in a process-wide cache, keyed by their source. Every add()
+    # compiles a bigger pattern, and the earlier ones, with the text of the secrets, would stay in that cache for
+    # the life of the process: hundreds of MiB after a few hundred token rotations, and secrets that outlive the
+    # masker. The cache is dropped; other modules only recompile their patterns once.
+    re.purge()
+    return pattern
+
+
+class SecretsMasker:
+    """Replaces every form of the secret values with the masked value in any text, for example in a formatted log line.
+
+    The case of the text does not matter: a key is logged upper-case as often as lower-case. New secrets can be added
+    later with `add()`, for a service that configures logging before it reads its config. A value of a type the masker
+    cannot search (`SUPPORTED_TYPES` lists the supported ones) raises `TypeError`, in the constructor and in `add()`.
+    """
+
+    def __init__(self, secrets: Mapping[str, object]):
+        self._lock = threading.Lock()
+        self._forms: frozenset[str] = frozenset()
+        # One pattern for ASCII text, matched on the lower-cased text (same offsets, half the cost), and one
+        # case-insensitive pattern for text whose lower case may change the offsets.
+        self._pattern_ascii: re.Pattern[str] | None = None
+        self._pattern: re.Pattern[str] | None = None
+        self.add(secrets)
+
+    def add(self, secrets: Mapping[str, object]) -> None:
+        """Mask the values of these secrets too, in every line from now on."""
+        new_forms = _secret_values(secrets)
+        with self._lock:
+            forms = self._forms | new_forms
+            if forms == self._forms:
+                return
+            pattern_ascii = _compile((form.lower() for form in forms), 0)
+            pattern = _compile(forms, re.IGNORECASE)
+            self._forms, self._pattern_ascii, self._pattern = forms, pattern_ascii, pattern
+
+    def __repr__(self) -> str:
+        return f'{type(self).__name__}({len(self._forms)} forms)'
+
+    def mask(self, text: str) -> str:
+        pattern_ascii, pattern = self._pattern_ascii, self._pattern
+        if pattern is None or pattern_ascii is None:
+            return text
+        matches = pattern_ascii.finditer(text.lower()) if text.isascii() else pattern.finditer(text)
+
+        spans: list[list[int]] = []
+        for match in matches:
+            start, end = match.start(), match.start() + len(match[1])
+            if spans and start <= spans[-1][1]:
+                spans[-1][1] = max(spans[-1][1], end)
+            else:
+                spans.append([start, end])
+        if not spans:
+            return text
+
+        parts: list[str] = []
+        last = 0
+        for start, end in spans:
+            parts.append(text[last:start])
+            parts.append(MASKED_VALUE)
+            last = end
+        parts.append(text[last:])
+        return ''.join(parts)

logmask/structlog_processor.py

@@ -0,0 +1,27 @@
+from collections.abc import Callable
+from typing import Any
+
+from .secrets import SecretsMasker
+
+Processor = Callable[[Any, str, Any], Any]
+
+
+def mask_secrets_processor(masker: SecretsMasker) -> Processor:
+    """A structlog processor that masks the rendered line.
+
+    Put it last, after the renderer: it then masks the whole line, keys and JSON-escaped forms included. It accepts
+    the output of a renderer, a `str` or `bytes`, and raises TypeError for anything else (an event dict): placed
+    before the renderer it could not mask the objects inside the event, and a silent partial masking is worse than a
+    failure at the first log call. The module does not import structlog: the processor is a plain function with the
+    `(logger, method_name, event_dict)` contract, the service brings its own structlog.
+    """
+
+    def processor(logger: Any, method_name: str, event: Any) -> Any:
+        if isinstance(event, str):
+            return masker.mask(event)
+        if isinstance(event, bytes):
+            text = event.decode('utf-8', errors='surrogateescape')
+            return masker.mask(text).encode('utf-8', errors='surrogateescape')
+        raise TypeError(f'mask_secrets_processor must be the last processor, after the renderer; got {type(event).__name__}')
+
+    return processor

logmask-0.1.3.dist-info/METADATA

@@ -0,0 +1,379 @@
+Metadata-Version: 2.4
+Name: logmask
+Version: 0.1.3
+Summary: JSON logging with masked secrets for Python services
+License-Expression: MIT
+License-File: LICENSE
+Author: Lido
+Requires-Python: >=3.12,<4
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
+Project-URL: Repository, https://github.com/lidofinance/logmask
+Description-Content-Type: text/markdown
+
+# logmask
+
+JSON logging for Python services, with secrets masked. Every log line is one JSON object. Every line goes through a masker that replaces every form of your secret values with `***`. This includes the messages of third-party libraries, warnings, and the traceback of an unhandled exception.
+
+No runtime dependencies. Python 3.12 or newer.
+
+## Install
+
+```bash
+poetry add git+https://github.com/lidofinance/logmask.git@v0.1.3
+```
+
+Pin a tag, or a commit with `rev`, and commit `poetry.lock`: it records the exact commit. Poetry clones the repository itself; a build stage that installs with `pip` needs `git`.
+
+## Quick start
+
+```py
+import logging
+
+from logmask import masked_config, setup_logging
+
+PUBLIC = {'RPC_TIMEOUT': 30, 'DRY_RUN': True}
+PRIVATE = {'RPC_URL': 'https://rpc.example.com/v3/a1b2c3d4e5f6', 'API_TOKEN': 'tok_9f8e7d6c5b4a'}
+
+setup_logging(PRIVATE)
+
+logger = logging.getLogger(__name__)
+logger.info({'msg': 'Config', 'value': masked_config(PUBLIC, PRIVATE)})
+logger.info('Connecting to %s', PRIVATE['RPC_URL'])
+```
+
+Output (one line per record, stderr):
+
+```json
+{"name": "app", "levelname": "INFO", "funcName": "main", "lineno": 12, "module": "main", "pathname": "/app/main.py", "timestamp": 1761600000, "msg": "Config", "value": {"RPC_TIMEOUT": 30, "DRY_RUN": true, "RPC_URL": "***", "API_TOKEN": "***"}}
+{"name": "app", "levelname": "INFO", "funcName": "main", "lineno": 13, "module": "main", "pathname": "/app/main.py", "timestamp": 1761600000, "msg": "Connecting to ***"}
+```
+
+`setup_logging(PRIVATE)` does four things:
+
+- configures the root logger: JSON lines to stderr, level INFO, old handlers removed
+- masks every line with every form of the values of `PRIVATE`
+- routes `warnings.warn()` through the logger, so a warning text is masked too
+- installs `sys.excepthook`, `threading.excepthook` and `sys.unraisablehook`, so an unhandled exception becomes one CRITICAL line with a masked traceback
+
+`masked_config(PUBLIC, PRIVATE)` builds a dict for the startup log. Public values stay as they are. Private values become `***`. A private list keeps its length. An unset private value (`None`, `''` or `b''`) becomes `''`, so you can see which variables are set; any other value, `0` and `False` included, is set and shows `***`. A key present in both dicts raises `ValueError`, and a private value of a type the masker cannot search raises `TypeError` (see "What is masked").
+
+```py
+masked_config({'PORT': 9000}, {'TOKEN': 'abc', 'RPC_URLS': ['a', 'b'], 'OPTIONAL_KEY': None})
+# {'PORT': 9000, 'TOKEN': '***', 'RPC_URLS': ['***', '***'], 'OPTIONAL_KEY': ''}
+```
+
+Every value of `PRIVATE` is treated as a secret, whatever it looks like (`None` and booleans are not values). Put a variable there only when its value must never appear in a log: a value such as `true` or `9000` in `PRIVATE` would be masked inside every line, field names included. A realistic set of secrets (about 20 variables, about 100 forms) costs about 50 microseconds per line; hundreds of secrets make every line noticeably slower.
+
+## How to
+
+### Log a message
+
+A string message goes to the `msg` field. A dict message is merged into the line, so its keys become fields:
+
+```py
+logger.info('Report sent for slot %d', 1234567)
+# {..., "msg": "Report sent for slot 1234567"}
+
+logger.info({'msg': 'Report sent', 'slot': 1234567, 'root': b'\x0a\x0b'})
+# {..., "msg": "Report sent", "slot": 1234567, "root": "0x0a0b"}
+```
+
+### Log an exception
+
+```py
+try:
+    client.get(url)
+except ConnectionError:
+    logger.exception('Request failed')
+# {..., "levelname": "ERROR", "msg": "Request failed", "exc_info": "Traceback (most recent call last):\n  ...\nConnectionError: Max retries exceeded with url: ***"}
+```
+
+### Set the level and the stream
+
+```py
+setup_logging(PRIVATE, level=os.getenv('LOG_LEVEL', 'INFO'), stream=sys.stdout)
+```
+
+`level` takes a name in any case or an int. `stream` is stderr by default. Three outputs always go to stderr: the traceback of a KeyboardInterrupt, the report of a handler that cannot write, and the line written when the exception hook itself fails.
+
+### Add secrets later
+
+`setup_logging` returns the masker. Pass `{}` and call `add()` when a secret becomes known after logging is configured, for example a token fetched from a vault or a config module that logs at import time:
+
+```py
+masker = setup_logging({})
+
+from app import config  # logs at import time, before the config is known
+
+masker.add(config.PRIVATE)
+```
+
+Every line from that point on is masked with the new values too. The lines written before `add()` are not. A second `setup_logging` call in the same process adds its secrets to the same masker, so the secrets of the first call stay masked.
+
+### Mask text by hand
+
+```py
+masker = setup_logging(PRIVATE)
+masker.mask('connect https://rpc.example.com/v3/a1b2c3d4e5f6')
+# 'connect ***'
+```
+
+### Use structlog
+
+Call `setup_logging` as well: structlog does not route the standard-library loggers of `web3`, `urllib3` or `requests` anywhere, and without a configured root logger their warnings go to stderr unmasked.
+
+```py
+import structlog
+
+from logmask import mask_secrets_processor, setup_logging
+
+masker = setup_logging(PRIVATE)
+structlog.configure(
+    processors=[
+        structlog.processors.add_log_level,
+        structlog.processors.TimeStamper(fmt='iso'),
+        structlog.processors.JSONRenderer(),
+        mask_secrets_processor(masker),  # last: masks the rendered line
+    ],
+)
+```
+
+The processor must be the last one, after the renderer: it masks the rendered line, keys and JSON-escaped forms included. Placed earlier it receives the event dict and raises `TypeError` at the first event that reaches the processors, which with a filtering logger is the first event at or above the configured level, not the first call. Do not render tracebacks with `structlog.processors.dict_tracebacks` in its default form: it prints the local variables of every frame cut to 80 characters, and a cut secret is a part that no form matches. Use `format_exc_info`, or `ExceptionRenderer(ExceptionDictTransformer(show_locals=False))`. The package does not depend on structlog: your service installs its own version.
+
+### Use the pieces one by one
+
+`setup_logging` wires these classes; they can be used directly, and each of them requires the masker:
+
+- `SecretsMasker(secrets)` - the masker; `mask(text)` and `add(secrets)`
+- `JsonFormatter(masker)` - one JSON object per record, masked
+- `SafeStreamHandler(stream, masker=masker)` - a `StreamHandler` that does not print the record when the write fails
+- `install_excepthook(masker=masker)` - the three exception hooks; the masker covers the output that cannot go through the logger
+
+## What is masked
+
+The examples use this masker:
+
+```py
+masker = SecretsMasker(
+    {
+        'RPC_URL': 'https://rpc.example.com/v3/a1b2c3d4e5f6/',
+        'CL_URL': 'https://user:s3cretPassw0rd@beacon.example.com/',
+        'API_TOKEN': 'tok_9f8e7d6c5b4a\n',  # read from a file, with the trailing newline
+        'RPC_LIST': ['https://one.example.com/key/abcdef123456', 'https://two.example.com/key/ghijkl789012'],
+        'KEYS': {'nested-secret-key': 'nested-secret-value'},
+        'PRIVATE_KEY': '0xABCDEF0123456789',
+        'RAW_KEY': b'\xde\xad\xbe\xef\x01\x02\x03\x04',
+    }
+)
+```
+
+Each value, each item of a list, tuple, set or any other iterable, the keys and the values of a nested dict (only the top-level keys are the variable names, they stay), the fields of a dataclass, the value behind a `SecretStr`-like object (`get_secret_value()`), numbers and paths by their text:
+
+```py
+masker.mask('connect https://rpc.example.com/v3/a1b2c3d4e5f6/')
+# 'connect ***'
+masker.mask('rpc https://two.example.com/key/ghijkl789012 failed')
+# 'rpc *** failed'
+masker.mask('KEYS nested-secret-key nested-secret-value')
+# 'KEYS *** ***'
+```
+
+A value of any other type (a plain object, a function, a module, a class) raises `TypeError` in `setup_logging`, `SecretsMasker`, `add()` and `masked_config`: the masker cannot promise to find every secret inside it, so it refuses the value instead of masking a part. Pass the data of such an object as a dict.
+
+The values held by one string: a JSON document is searched as the container it encodes (a list of URLs, the JSON of a service account with its `private_key`), several URLs separated by commas, semicolons or white space are searched one by one, and every line of a multi-line value (a PEM key) is a secret on its own:
+
+```py
+masker = SecretsMasker({'RPC_LIST': 'https://one.example.com/key/abcdef123456,https://two.example.com/key/ghijkl789012'})
+masker.mask('rpc https://one.example.com/key/abcdef123456 failed, path /key/abcdef123456')
+# 'rpc *** failed, path ***'
+masker = SecretsMasker(
+    {'ACCOUNT': '{"type": "service_account", "private_key": "-----BEGIN KEY-----\\nMIIEvQIBADANBg\\n-----END KEY-----"}'}
+)
+masker.mask('key MIIEvQIBADANBg of type service_account')
+# 'key *** of *** ***'
+```
+
+The value without spaces and newlines around it, and without a trailing `/`:
+
+```py
+masker.mask('token tok_9f8e7d6c5b4a expired')
+# 'token *** expired'
+masker.mask('connect https://rpc.example.com/v3/a1b2c3d4e5f6')
+# 'connect ***'
+```
+
+The parts of a URL on their own: the host with its credentials, the path, the path with the query, the query, each `name=value` pair, the user name, the password and `user:password`, percent-decoded as well, and the credentials as an HTTP Basic header. HTTP libraries often log only the path:
+
+```py
+masker.mask("HTTPSConnectionPool(host='rpc.example.com', port=443): Max retries exceeded with url: /v3/a1b2c3d4e5f6")
+# "HTTPSConnectionPool(host='rpc.example.com', port=443): Max retries exceeded with url: ***"
+masker.mask('GET https://user:s3cretPassw0rd@beacon.example.com/eth/v1/beacon/genesis')
+# 'GET ***eth/v1/beacon/genesis'
+masker.mask('auth user:s3cretPassw0rd rejected, header Basic dXNlcjpzM2NyZXRQYXNzdzByZA==')
+# 'auth *** rejected, header Basic ***'
+```
+
+A single segment of the path, a single query value and the host without its credentials, when they can be a key: 16 characters or more, or 8 or more with a digit. A short word of a URL (`eth`, `v1`, a host like `el`) is masked only as part of the whole path or URL, otherwise it would vanish from every line:
+
+```py
+masker.mask('project a1b2c3d4e5f6 rate limited, host beacon.example.com')
+# 'project *** rate limited, host ***'
+masker.mask('GET /eth/v1/beacon/genesis from rpc.example.com')
+# 'GET /eth/v1/beacon/genesis from rpc.example.com'
+```
+
+Hex values in any case, with and without `0x`, and as the bytes they encode. Bytes as text, as hex and as their `repr()`:
+
+```py
+masker.mask('key 0xabcdef0123456789 or ABCDEF0123456789 or 0XABCDEF0123456789')
+# 'key *** or *** or ***'
+masker.mask("raw 0xdeadbeef01020304 DEADBEEF01020304 b'\\xde\\xad\\xbe\\xef\\x01\\x02\\x03\\x04'")
+# "raw *** *** b'***'"
+masker.mask(repr(bytes.fromhex('ABCDEF0123456789')))
+# "b'***'"
+```
+
+The value percent-encoded (with `quote` and with `quote_plus`), percent-decoded, base64-encoded, and as the hex or the `repr()` of its bytes, as an application writes it into a URL, a header or a bytes body:
+
+```py
+SecretsMasker({'T': 'tok/en+value=1'}).mask('k=tok%2Fen%2Bvalue%3D1 auth dG9rL2VuK3ZhbHVlPTE= body 0x746f6b2f656e2b76616c75653d31')
+# 'k=*** auth *** body 0x***'
+```
+
+A value shown with `repr()`, inside `str(dict)`, in an exception text or inside a JSON document, up to two layers deep (for example the `repr()` of a JSON document). Quotes, backslashes and newlines in the secret are not a problem, and a secret made of JSON syntax (a quote, a brace, `true`) is masked inside the strings of the line, so the line stays valid JSON:
+
+```py
+password = 'pa"ss\\word\n123'
+masker.add({'PASSWORD': password})
+logger.info('login %r failed with %s', password, json.dumps({'password': password}))
+# {..., "msg": "login '***' failed with {\"password\": \"***\"}"}
+```
+
+The case of the text does not matter:
+
+```py
+masker.mask('TOK_9F8E7D6C5B4A')
+# '***'
+```
+
+Numbers and other non-string values, by their text:
+
+```py
+SecretsMasker({'PIN': 12345678}).mask('pin 12345678')
+# 'pin ***'
+```
+
+Two secrets that overlap in the text are masked as one:
+
+```py
+SecretsMasker({'A': 'abcdefgh', 'B': 'efghijklmnop'}).mask('abcdefghijklmnop')
+# '***'
+```
+
+## What is not masked
+
+A value that is not in your secrets. The masker replaces known values, it does not search for text that looks like a secret:
+
+```py
+masker.mask('other secret zzz-not-configured')
+# 'other secret zzz-not-configured'
+```
+
+A form of the value the masker does not know: a part of the value, a hash of it, more than two layers of escaping:
+
+```py
+masker.mask('prefix a1b2c3')
+# 'prefix a1b2c3'
+```
+
+A short word of a URL on its own (see above).
+
+A password re-encoded by an HTTP library with its own set of safe characters. The masker knows the password raw, percent-decoded and in the three encodings of `urllib.parse` (`quote` with and without the default safe characters, `quote_plus`). yarl, used by aiohttp, keeps `+ ! & =` raw and encodes the rest, so `p%40ss+x!y` is a form the masker does not know, and only the user name and the host of such a URL are masked. A per-character pattern for the credentials (each character raw or percent-encoded) is planned; until then, prefer a password without characters that need encoding.
+
+Text that does not pass through the handler installed by `setup_logging`:
+
+- `print`, a library that writes to the stream directly, and the message of `sys.exit('...')`, which the interpreter prints without calling the exception hook
+- a logger with its own handler that does not propagate to the root logger (a logger without any handler that does not propagate goes to `logging.lastResort`, which `setup_logging` replaces by a masked handler)
+- a handler added to the root logger after `setup_logging` (a `FileHandler`, the handler of an error tracker), and a `logging.config.dictConfig` call after it: they format the record themselves
+- a child process of `multiprocessing`: with the `fork` start method, an exception in the child is printed by `multiprocessing` itself, without the hooks; with `spawn`, the child starts without `setup_logging` unless its module calls it
+
+## When logging itself fails
+
+A record that cannot be formatted (wrong `%` arguments, a value `json` cannot serialize, a dict message nested deeper than the recursion limit) is still written as one masked JSON line, with the problem in the `error` field. Every line the library writes on its own behalf, instead of the record, starts with `[logmask]`:
+
+```py
+logger.info('rpc %d %s', 'https://rpc.example.com/v3/a1b2c3d4e5f6', 'x')
+# {..., "msg": "rpc %d %s", "error": "[logmask] Log record could not be formatted: TypeError('%d format: a real number is required, not str')", "args": "('***', 'x')"}
+```
+
+The standard library would print this instead, to stderr and without masking:
+
+```text
+--- Logging error ---
+Traceback (most recent call last):
+  ...
+TypeError: %d format: a real number is required, not str
+Message: 'rpc %d %s'
+Arguments: ('https://rpc.example.com/v3/a1b2c3d4e5f6', 'x')
+```
+
+A record that cannot be written (the stream is closed, the pipe is broken) is reported by `SafeStreamHandler` without the record, where the standard handler would print the same `Message:` and `Arguments:` lines as above:
+
+```text
+--- [logmask] Logging error: BrokenPipeError(32, 'Broken pipe') (record from app, /app/main.py:31) ---
+```
+
+An unhandled exception goes through the logger as a CRITICAL line:
+
+```py
+raise ConnectionError(f'Max retries exceeded with url: {RPC_URL}')
+# {"name": "unhandled", "levelname": "CRITICAL", ..., "msg": "Unhandled exception. Shut down.", "error": "Traceback (most recent call last):\n  ...\nConnectionError: Max retries exceeded with url: ***\n"}
+```
+
+An exception in another thread gives the same line with `"msg": "Unhandled exception in a thread."` and a `thread` field; the process goes on, as with the default hook. An exception in `__del__` or in a callback (`sys.unraisablehook`) gives `"msg": "Unraisable exception."`.
+
+Three cases cannot go through the logger and are written to stderr masked: a `KeyboardInterrupt` (Ctrl-C is not an error, so there is no CRITICAL line, the traceback is printed as plain text), an exception when no handler is configured (one JSON line written by the hook itself), and a failure of the hook (one line with the exception name).
+
+## Log format
+
+Every line has these fields, in this order:
+
+```json
+{"name": "app", "levelname": "INFO", "funcName": "main", "lineno": 29, "module": "main", "pathname": "/app/main.py", "timestamp": 1761600000, "msg": "Config", "value": {"RPC_URL": "***"}}
+```
+
+- `name`, `levelname`, `funcName`, `lineno`, `module`, `pathname` - from the log record
+- `timestamp` - the record time in whole seconds
+- `msg` - the string message; a dict message adds its keys after `timestamp` instead. A dict key with the name of a record field (for example `name`) is written as `msg_name`
+- `exc_info` - the traceback, for `logger.exception()` and `exc_info=True`
+- bytes are written as `0x`-hex, dataclasses as dicts, sets as lists, other unknown values as text
+
+## Development
+
+```bash
+poetry install
+poetry run ruff format --check . && poetry run ruff check . && poetry run pyright logmask tests
+poetry run pytest
+```
+
+Mutation tests check that the suite notices a weaker masker. They run in CI on every push and pull request; locally:
+
+```bash
+poetry run pip install "mutmut==3.8.1"
+poetry run mutmut run
+poetry run mutmut results           # the survivors
+poetry run mutmut show <mutant>     # the diff of one survivor
+```
+
+About 50 mutants survive by design (the spelling of `utf-8`, the wording of messages, the references kept by the cycle guard); CI fails above that number.
+
+## Release
+
+1. Set the version in `pyproject.toml` and move the `Unreleased` section of `CHANGELOG.md` under the version and the date.
+2. Merge to `main` and create the tag `vX.Y.Z`.
+3. Consumers update the tag in their `pyproject.toml` and run `poetry lock`.
+

logmask-0.1.3.dist-info/RECORD

@@ -0,0 +1,13 @@
+logmask/__init__.py,sha256=UlxYUfyJKYTg1xsvyht2UDGLSxoq4kuP_a88emAWgPA,495
+logmask/config.py,sha256=yT6bMassP-nVaIoPv4LsBlUME1dOdr6LsDLCCvX57EM,1289
+logmask/configure.py,sha256=HBVX3m6lNf3_8mofkfDamsCE5d9llbMTcMj4KhN0AHA,2444
+logmask/excepthook.py,sha256=bqbsJcZbXtBwbcp0W2hWm1FUEZne0y41kCUmgbNDmtk,4831
+logmask/formatter.py,sha256=RoCY3DNmD232oen27bLjtZ2jCKkIx4YlBAPsrad14xQ,4672
+logmask/handler.py,sha256=VWXgv8vcIGvLzB1dRhO99fmRXeSGDSz_lzwcibni9WE,1163
+logmask/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+logmask/secrets.py,sha256=aStieUQ-U6H-xkmNdCfxAhUaK4EaRFABwSfaQzpSIr8,13293
+logmask/structlog_processor.py,sha256=2xhxFbqaBUYa-SQPEtiFZgbBt6KrcLiG30735U190Xc,1298
+logmask-0.1.3.dist-info/METADATA,sha256=DOW4BgTTH6w-3SD3my9hqCr4UY0dBcc2zKs9k7czOjM,18594
+logmask-0.1.3.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
+logmask-0.1.3.dist-info/licenses/LICENSE,sha256=LpEi6KieJAlefSgmC1tWdhIUzPCoAis2DEZRzQbD6e0,1061
+logmask-0.1.3.dist-info/RECORD,,

logmask-0.1.3.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.5.0
+Root-Is-Purelib: true
+Tag: py3-none-any

logmask-0.1.3.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Lido
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.