Feature/redact sensitive output - #102
Closed
brandonc wants to merge 3 commits into
Closed
Conversation
Some API responses carry credentials and tfctl prints them. A created token is returned once in full, and a state version carries download URLs that grant the state itself without a token. AGENTS.md already requires that a displayer payload never include credentials, noting that JSON output serializes the full payload rather than the displayed fields. JSONAPIDisplayer cannot honor that, because it carries whatever the server returned, and ExcludeColumns does not help: it feeds FieldTemplates for table and pretty output while outputJSON marshals the raw envelope. Add internal/pkg/redact and apply it in format.Outputter.Display, before the format is selected, so every format agrees and a --jq filter cannot reach a value that --json would have hidden. Cover Outputter.CopyRaw for bodies no displayer handles, such as plan JSON, and the --dry-run request preview, which otherwise echoes the value being set. Masking is controlled by the redact profile property, TFCTL_REDACT, or --no-redact, with modes strict (default), known, and off. Copying is on write, so a response with nothing to mask costs no allocation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
#101 plus a skill update