admin
544c42a618
- metrics: LogIssue.Context on first-occurrence errors (≤11 lines, ≤400 chars/line, warns carry none); RedactLine sanitizer (password/token/api-key/bearer/64-hex) applied to everything shipped; FetchContainerLogTail - report: 16KB per-report context budget (lowest-count issues dropped first); log_tail_requests ACK flag → next report ships log_tails (200 lines, ≤64KB/app head-truncated, ordered, redacted); consume-once drain - tests: synthetic-window context capture, caps, redaction, budget order, consume-once, fetch-error skip Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
23 lines
1004 B
Go
23 lines
1004 B
Go
package metrics
|
|
|
|
import "regexp"
|
|
|
|
// Redaction is controller-side and authoritative: every context line and log-tail line
|
|
// must pass through RedactLine before it leaves the box (rides the hub report).
|
|
var (
|
|
// key[=: ]value shapes — the value is masked. The optional "bearer " prefix inside the
|
|
// value group catches "Authorization: Bearer <token>" in one pass.
|
|
reSecretKV = regexp.MustCompile(`(?i)\b(password|passwd|secret|token|api[_-]?key|authorization|bearer)([=: ]\s*)((?:bearer\s+)?\S+)`)
|
|
// 64-hex string = restic repo password / key-material shape.
|
|
reHex64 = regexp.MustCompile(`\b[0-9a-fA-F]{64}\b`)
|
|
)
|
|
|
|
// RedactLine masks secret-shaped values in a log line. Applied to context lines and
|
|
// log-tail lines before shipping; deliberately narrow (support usefulness over
|
|
// aggression) but the named patterns are non-negotiable.
|
|
func RedactLine(s string) string {
|
|
s = reSecretKV.ReplaceAllString(s, "${1}${2}[REDACTED]")
|
|
s = reHex64.ReplaceAllString(s, "[REDACTED-HEX64]")
|
|
return s
|
|
}
|