Package com.tnsai.quality.redaction

Interface Redactor

All Known Implementing Classes:
AuditingRedactor, CompositeRedactor, PatternRedactor, TenantPolicyRedactor
public interface Redactor
SPI for scrubbing PII / secrets out of strings or structured values before they leave the framework's internal boundaries — log lines, trace attributes, memory writes, captured LLM prompts (issue #80).

Implementations MUST be thread-safe (one instance is shared across every emit site in the framework) and MUST be idempotent — scrubString(scrubString(x)) produces the same text + same findings as scrubString(x), never different placeholders.

Network-touching redactors (LLM-classifier, Presidio bridges) inherit the same SPI but typically wrap blocking work behind an executor; the default PatternRedactor stays on the caller thread because regex matching is fast enough for the common case.

Since:
0.5.0 (issue #80)

  • Method Details

    • scrubString

      RedactionResult scrubString(String input, RedactionContext ctx)
      Scrub sensitive patterns out of input, returning the redacted text + every match.
      Parameters:
      input - plaintext to scan; never null. "" is acceptable and returns an unchanged result.
      ctx - per-call context (sink, tenant policy)
      Returns:
      redacted text + findings; never null

    • scrubValue

      default Object scrubValue(Object input, RedactionContext ctx)
      Recursive scrub of a structured value — Map, List, or scalar. Walks Map<String, Object> and List<Object> (the framework's two carry-over container types from JSON deserialization), applying scrubString(java.lang.String, com.tnsai.quality.redaction.RedactionContext) to every leaf String. Other scalars pass through unchanged.

      Default implementation handles Maps + Lists; redactors that need to peek into custom types override.

    • maybeContainsSensitive

      default boolean maybeContainsSensitive(String input)
      Cheap pre-check: returns true when input might contain something worth scanning. Lets the framework short-circuit the regex loop on guaranteed-clean strings (UUIDs, numeric IDs, fixed-vocabulary enums). Default true because the safe fallback is "always scan"; override when you can do better.