Class PatternRedactor

java.lang.Object
com.tnsai.quality.redaction.PatternRedactor
All Implemented Interfaces:
Redactor

public final class PatternRedactor extends Object implements Redactor
Regex-driven Redactor (issue #80). Default in-process implementation — applies a list of RedactionPatterns in order and replaces every match (passing the pattern's optional validator) with a stable placeholder.

Idempotency

The placeholder format is [REDACTED:<pattern_name>]. Placeholders themselves don't match any of the default patterns, so a second pass finds no further matches — Redactor.scrubString(java.lang.String, com.tnsai.quality.redaction.RedactionContext) is therefore idempotent on this implementation.

Overlap handling

When two patterns match overlapping spans, the longer match wins; tie-breaks favor the higher-severity pattern. This avoids the "credit card pattern matches inside a JWT digit run" failure mode where a more specific match (JWT) is shadowed by a more generic one.

Thread safety

Stateless — patterns are immutable, the matcher is created per call. Safe to share one instance across the entire framework.
Since:
0.5.0 (issue #80)
  • Constructor Details

  • Method Details

    • withDefaults

      public static PatternRedactor withDefaults()
      Convenience: redactor pre-loaded with RedactionPatterns.defaults().
    • scrubString

      public RedactionResult scrubString(String input, RedactionContext ctx)
      Description copied from interface: Redactor
      Scrub sensitive patterns out of input, returning the redacted text + every match.
      Specified by:
      scrubString in interface Redactor
      Parameters:
      input - plaintext to scan; never null. "" is acceptable and returns an unchanged result.
      ctx - per-call context (sink, tenant policy)
      Returns:
      redacted text + findings; never null
    • maybeContainsSensitive

      public boolean maybeContainsSensitive(String input)
      Description copied from interface: Redactor
      Cheap pre-check: returns true when input might contain something worth scanning. Lets the framework short-circuit the regex loop on guaranteed-clean strings (UUIDs, numeric IDs, fixed-vocabulary enums). Default true because the safe fallback is "always scan"; override when you can do better.
      Specified by:
      maybeContainsSensitive in interface Redactor