Core: Add Support for Context-Aware Redaction Scenarios

[matthewgoluba]

Simple regex is sometimes not enough. We need 'scenarios' where redaction only happens based on context (e.g., 'Password = [value]'). This is crucial for reducing false positives in logs while catching sensitive keys.

Tasks:

• Extend Pattern class to support lookbehind or context rules.
• Implement a Scenario interface in packages/core.
• Add a test case for a common log scenario (e.g., Authorization: Bearer [token]).

Implemented Scenarios:

• AuthorizationHeaderScenario
• PasswordScenario
• ApiKeyScenario
• ConnectionStringScenario
• PrivateKeyScenario
• AWSCredentialsScenario

[goobz22]

Implementation Notes Based on Codebase Review

Current Pattern Architecture

The BasePattern class in packages/core/src/patterns/base.ts:

• Properties: name, regex, strategy, enabled
• Methods: test(), findAll(), setStrategy(), setEnabled()

This only supports simple regex matching - no context awareness.

Suggested Implementation

1. Create packages/core/src/patterns/contextual.ts

Create a ContextualPattern class that extends BasePattern with:

• ContextRule interface with prefix/suffix patterns and valuePattern
• Override findAll() to use lookbehind/lookahead assertions
• Pre-built patterns: AuthHeaderPattern, KeyValuePattern

2. Pre-built Contextual Patterns

AuthHeaderPattern rules:

• Authorization: Bearer [JWT token]
• Authorization: Basic [base64]
• X-API-Key: [key]

KeyValuePattern rules:

• password = [value]
• secret = [value]
• api_key = [value]
• token = [value]

3. Update types.ts
Add contextual pattern config support to RedactorConfig

Test Cases

Should redact:

• Authorization: Bearer eyJhbGciOiJIUzI1... (with context)
• password = SuperSecret123

Should NOT redact:

• eyJhbGciOiJIUzI1... (JWT without Authorization prefix)
• SuperSecret123 (value without password prefix)

Considerations

• Lookbehind has limited browser support - may need alternative for client-side
• Performance impact of multiple regex passes
• Allow users to define custom contextual rules via config

[goobz22]

Implementation Complete

Created context-aware redaction scenarios in packages/core/src/scenarios/:

Scenario Classes

• AuthorizationHeaderScenario - Matches Authorization: Bearer/Basic <token>
• PasswordScenario - Matches password = value, passwd: value, pwd=value
• ApiKeyScenario - Matches api_key = value, secret_key=value
• ConnectionStringScenario - Matches DB connection strings with passwords
• PrivateKeyScenario - Matches PEM-formatted private keys
• AWSCredentialsScenario - Matches AWS access/secret keys

How It Works

Scenarios use capture groups to only redact the sensitive value, not the context:

Input:  password = secretValue123
Output: password = [PASSWORD_1]

Files Created

• packages/core/src/scenarios/base.ts - BaseScenario class and implementations
• packages/core/src/scenarios/index.ts - Exports
• Updated packages/core/src/types.ts - ScenarioConfig interface
• Updated packages/core/src/engine.ts - Scenario processing

Ready to close.

[goobz22]

Remaining: Test cases for scenarios need to be added.