41 lines
1.4 KiB
TypeScript
41 lines
1.4 KiB
TypeScript
export type SensitiveClassification = 'secret' | 'pii';
|
|
|
|
export interface RedactionResult {
|
|
content: string;
|
|
classifications: SensitiveClassification[];
|
|
}
|
|
|
|
const SECRET_PATTERNS: RegExp[] = [
|
|
/\b(?:sk|ghp|gitea)_[A-Za-z0-9_-]{8,}\b/g,
|
|
/\b(?:api[_-]?key|token|password|secret)\s*[:=]\s*[^\s,;]+/gi,
|
|
/\b(?:authorization\s*:\s*)?bearer\s+[A-Za-z0-9._~+/-]+=*/gi,
|
|
/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
|
|
/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
|
|
/-----BEGIN(?: [A-Z]+)* KEY-----[\s\S]*?-----END(?: [A-Z]+)* KEY-----/g,
|
|
/https?:\/\/[^\s?#]+[^\s]*[?&](?:token|key|secret|signature|sig)=[^\s&#]+/gi,
|
|
];
|
|
const PII_PATTERNS: RegExp[] = [
|
|
/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,
|
|
/\b\+?\d[\d(). -]{7,}\d\b/g,
|
|
];
|
|
|
|
export function redactSensitiveContent(content: string): RedactionResult {
|
|
let redacted = content;
|
|
const classifications: SensitiveClassification[] = [];
|
|
for (const pattern of SECRET_PATTERNS) {
|
|
if (pattern.test(redacted)) {
|
|
classifications.push('secret');
|
|
redacted = redacted.replace(pattern, '[REDACTED_SECRET]');
|
|
}
|
|
pattern.lastIndex = 0;
|
|
}
|
|
for (const pattern of PII_PATTERNS) {
|
|
if (pattern.test(redacted)) {
|
|
classifications.push('pii');
|
|
redacted = redacted.replace(pattern, '[REDACTED_PII]');
|
|
}
|
|
pattern.lastIndex = 0;
|
|
}
|
|
return { content: redacted, classifications: [...new Set(classifications)] };
|
|
}
|