`lib/redact.js`

27 lines
'use strict';
// Redact known fleet-secret shapes from any chunk before it is embedded/persisted.
// Added 2026-06-24 (fleet-rag-secret-spillage remediation): the ingestion pipeline
// slurped server.js heads + memory files verbatim, capturing plaintext secrets into
// data/vectors.jsonl. This filter neutralizes known secret shapes at ingest time so a
// rebuilt index carries no live credential even when a source file still holds one.
const PATTERNS = [
  [/AIza[A-Za-z0-9_\-]{35}/g,                                  '[REDACTED_GEMINI_KEY]'],
  [/shpat_[a-f0-9]{32}/g,                                       '[REDACTED_SHOPIFY_TOKEN]'],
  [/shpss_[a-f0-9]{32}/g,                                       '[REDACTED_SHOPIFY_SECRET]'],
  [/shpca_[a-f0-9]{32}/g,                                       '[REDACTED_SHOPIFY_SECRET]'],
  [/https?:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9\/]+/g,   '[REDACTED_SLACK_WEBHOOK]'],
  [/postgres(?:ql)?:\/\/[^:\/\s]+:[^@\s]+@[^\s"'`]+/g,          '[REDACTED_PG_DSN]'],
  [/DW2024!!?/g,                                       '[REDACTED_PW]'],
  [/DWSecure2024!?/g,                                           '[REDACTED_PW]'],
  [/[A-Za-z0-9]*access911[A-Za-z0-9]*/g,                        '[REDACTED_VENDOR_PW]'],
  [/sk-[A-Za-z0-9]{20,}/g,                                      '[REDACTED_OPENAI_KEY]'],
  [/(?:r8_|ghp_|gho_|xoxb-|xoxp-)[A-Za-z0-9\-]{20,}/g,          '[REDACTED_TOKEN]'],
];
function redact(text) {
  if (!text) return text;
  let out = String(text);
  for (const [re, repl] of PATTERNS) out = out.replace(re, repl);
  return out;
}
module.exports = { redact };