
    Ji?                     T   d Z ddlZddlZddlZ ej        e          Z ej        dd                                          dvZ	g dZ
dZ ej        de d	ej                  Zd
Z ej        de dej                  Z ej        dej                  Z ej        d          Z ej        d          Z ej        dej                  Z ej        d          Z ej        dd                    e
          z   dz             ZdedefdZdedefdZ G d dej                  ZdS )a2  Regex-based secret redaction for logs and tool output.

Applies pattern matching to mask API keys, tokens, and credentials
before they reach log files, verbose output, or gateway logs.

Short tokens (< 18 chars) are fully masked. Longer tokens preserve
the first 6 and last 4 characters for debuggability.
    NHERMES_REDACT_SECRETS )0falsenooff)zsk-[A-Za-z0-9_-]{10,}zghp_[A-Za-z0-9]{10,}zgithub_pat_[A-Za-z0-9_]{10,}zgho_[A-Za-z0-9]{10,}zghu_[A-Za-z0-9]{10,}zghs_[A-Za-z0-9]{10,}zghr_[A-Za-z0-9]{10,}zxox[baprs]-[A-Za-z0-9-]{10,}zAIza[A-Za-z0-9_-]{30,}zpplx-[A-Za-z0-9]{10,}zfal_[A-Za-z0-9_-]{10,}zfc-[A-Za-z0-9]{10,}zbb_live_[A-Za-z0-9_-]{10,}zgAAAA[A-Za-z0-9_=-]{20,}zAKIA[A-Z0-9]{16}zsk_live_[A-Za-z0-9]{10,}zsk_test_[A-Za-z0-9]{10,}zrk_live_[A-Za-z0-9]{10,}zSG\.[A-Za-z0-9_-]{10,}zhf_[A-Za-z0-9]{10,}zr8_[A-Za-z0-9]{10,}znpm_[A-Za-z0-9]{10,}zpypi-[A-Za-z0-9_-]{10,}zdop_v1_[A-Za-z0-9]{10,}zdoo_v1_[A-Za-z0-9]{10,}zam_[A-Za-z0-9_-]{10,}zsk_[A-Za-z0-9_]{10,}ztvly-[A-Za-z0-9]{10,}zexa_[A-Za-z0-9]{10,}z9(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)z([A-Z_]*z[A-Z_]*)\s*=\s*(['\"]?)(\S+)\2z(?:api_?[Kk]ey|token|secret|password|access_token|refresh_token|auth_token|bearer|secret_value|raw_secret|secret_input|key_material)z("z")\s*:\s*"([^"]+)"z!(Authorization:\s*Bearer\s+)(\S+)z#(bot)?(\d{8,}):([-A-Za-z0-9_]{30,})zH-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----zK((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp)://[^:]+:)([^@]+)(@)z (\+[1-9]\d{6,14})(?![A-Za-z0-9])z(?<![A-Za-z0-9_-])(|z)(?![A-Za-z0-9_-])tokenreturnc                 Z    t          |           dk     rdS | dd          d| dd          S )z0Mask a token, preserving prefix for long tokens.   ***N   z...)len)r
   s    )/home/ubuntu/hermes-agent/agent/redact.py_mask_tokenr   e   s:    
5zzBuBQBi((E"##J(((    textc                 >   | dS t          | t                    st          |           } | s| S t          s| S t                              d |           } d }t
                              ||           } d }t                              ||           } t                              d |           } d }t                              ||           } t                              d|           } t                              d |           } d	 }t                              ||           } | S )
zApply all redaction patterns to a block of text.

    Safe to call on any string -- non-matching text passes through unchanged.
    Disabled when security.redact_secrets is false in config.yaml.
    Nc                 F    t          |                     d                    S )N   )r   groupms    r   <lambda>z'redact_sensitive_text.<locals>.<lambda>|   s    K

$;$; r   c                     |                      d          |                      d          |                      d          }}}| d| t          |           | S )Nr         =r   r   )r   namequotevalues       r   _redact_envz*redact_sensitive_text.<locals>._redact_env   sS    WWQZZQWWQZZUe;;;E 2 2;E;;;r   c                     |                      d          |                      d          }}| dt          |           dS )Nr   r   z: ""r!   )r   keyr$   s      r   _redact_jsonz+redact_sensitive_text.<locals>._redact_json   s>    WWQZZU//+e,,////r   c                 r    |                      d          t          |                      d                    z   S )Nr   r   r!   r   s    r   r   z'redact_sensitive_text.<locals>.<lambda>   s'    !''!**{1771::666 r   c                 h    |                      d          pd}|                      d          }| | dS )Nr   r   r   z:***r   )r   prefixdigitss      r   _redact_telegramz/redact_sensitive_text.<locals>._redact_telegram   s9    !r&&&&&&r   z[REDACTED PRIVATE KEY]c                 \    |                      d           d|                      d           S )Nr   r   r   r,   r   s    r   r   z'redact_sensitive_text.<locals>.<lambda>   s(    1771::(F(F!''!**(F(F r   c                     |                      d          }t          |          dk    r|d d         dz   |dd          z   S |d d         dz   |dd          z   S )Nr      r   z****   r   )r   r   )r   phones     r   _redact_phonez,redact_sensitive_text.<locals>._redact_phone   s`    

u::??!9v%bcc
22RaRy6!E"##J..r   )
isinstancestr_REDACT_ENABLED
_PREFIX_REsub_ENV_ASSIGN_RE_JSON_FIELD_RE_AUTH_HEADER_RE_TELEGRAM_RE_PRIVATE_KEY_RE_DB_CONNSTR_RE_SIGNAL_PHONE_RE)r   r%   r)   r/   r6   s        r   redact_sensitive_textrC   l   sO    |tdC   4yy   >>;;TBBD< < < k400D0 0 0 lD11D 66 D' ' ' ,d33D 7>>D FFMMD/ / /
 t44DKr   c                   B     e Zd ZdZd fd	Zdej        def fdZ xZ	S )	RedactingFormatterz9Log formatter that redacts secrets from all log messages.N%c                 @     t                      j        |||fi | d S N)super__init__)selffmtdatefmtstylekwargs	__class__s        r   rJ   zRedactingFormatter.__init__   s,    gu7777777r   recordr   c                 d    t                                          |          }t          |          S rH   )rI   formatrC   )rK   rQ   originalrP   s      r   rS   zRedactingFormatter.format   s&    77>>&))$X...r   )NNrF   )
__name__
__module____qualname____doc__rJ   logging	LogRecordr8   rS   __classcell__)rP   s   @r   rE   rE      sr        CC8 8 8 8 8 8/W. /3 / / / / / / / / / /r   rE   )rX   rY   osre	getLoggerrU   loggergetenvlowerr9   _PREFIX_PATTERNS_SECRET_ENV_NAMEScompile
IGNORECASEr<   _JSON_KEY_NAMESr=   r>   r?   r@   rA   rB   joinr:   r8   r   rC   	FormatterrE    r   r   <module>rj      s     				 						8	$	$ ")3R88>>@@Hcc   B Q A!AAAM  Z-/---M  "*(M  rz* 
 "*O  RM  2:ABB  RZSXX&6777:OO 

)s )s ) ) ) )9 9 9 9 9 9x/ / / / /* / / / / /r   