Cut configuration and CLI over to output cache and debug surfaces

internal/core/config/redaction.go

@@ -1,9 +1,13 @@
 package config
 
-import "gitea.maximumdirect.net/eric/notarius/internal/framework/pipeline"
+import (
+	"strings"
+
+	"gitea.maximumdirect.net/eric/notarius/internal/framework/pipeline"
+)
 
 func (c Config) Redacted() Config {
-	return cloneConfig(c)
+	return redactConfig(cloneConfig(c))
 }
 
 func (c Config) RedactedSummaryPayload() any {
@@ -23,10 +27,10 @@ func (e EffectiveConfig) RedactedSummaryPayload() any {
 
 func cloneResolvedPipeline(in pipeline.ResolvedPipeline) pipeline.ResolvedPipeline {
 	out := in
-	out.Input = cloneModuleBinding(in.Input)
-	out.Chunk = cloneModuleBinding(in.Chunk)
+	out.Input = redactBinding(cloneModuleBinding(in.Input))
+	out.Chunk = redactBinding(cloneModuleBinding(in.Chunk))
 	out.ChunkReferences = pipeline.CloneReferenceTarget(in.ChunkReferences)
-	out.Output = cloneModuleBinding(in.Output)
+	out.Output = redactBinding(cloneModuleBinding(in.Output))
 	if len(in.ValidatorChains) > 0 {
 		out.ValidatorChains = make([]pipeline.ResolvedValidatorChain, len(in.ValidatorChains))
 		for i, chain := range in.ValidatorChains {
@@ -48,7 +52,7 @@ func cloneResolvedValidatorChain(in pipeline.ResolvedValidatorChain) pipeline.Re
 		out.Validators = make([]pipeline.ResolvedValidator, len(in.Validators))
 		for i, validator := range in.Validators {
 			out.Validators[i] = pipeline.ResolvedValidator{
-				Binding:        cloneModuleBinding(validator.Binding),
+				Binding:        redactBinding(cloneModuleBinding(validator.Binding)),
 				ExecutionClass: validator.ExecutionClass,
 				Target:         validator.Target,
 				ArtifactKind:   validator.ArtifactKind,
@@ -60,17 +64,79 @@ func cloneResolvedValidatorChain(in pipeline.ResolvedValidatorChain) pipeline.Re
 
 func cloneResolvedArtifactLane(in pipeline.ResolvedArtifactLane) pipeline.ResolvedArtifactLane {
 	out := in
-	out.Extract = cloneModuleBinding(in.Extract)
-	out.Merge = cloneModuleBinding(in.Merge)
-	out.Normalize = cloneModuleBinding(in.Normalize)
+	out.Extract = redactBinding(cloneModuleBinding(in.Extract))
+	out.Merge = redactBinding(cloneModuleBinding(in.Merge))
+	out.Normalize = redactBinding(cloneModuleBinding(in.Normalize))
 	out.ExtractReferences = pipeline.CloneReferenceTarget(in.ExtractReferences)
 	out.MergeReferences = pipeline.CloneReferenceTarget(in.MergeReferences)
 	out.NormalizeReferences = pipeline.CloneReferenceTarget(in.NormalizeReferences)
 	if len(in.Validators) > 0 {
 		out.Validators = make([]pipeline.ModuleBinding, len(in.Validators))
 		for i, binding := range in.Validators {
-			out.Validators[i] = cloneModuleBinding(binding)
+			out.Validators[i] = redactBinding(cloneModuleBinding(binding))
 		}
 	}
 	return out
 }
+
+func redactConfig(cfg Config) Config {
+	for id, profile := range cfg.Pipelines {
+		profile.Input = redactBinding(profile.Input)
+		profile.Chunk = redactBinding(profile.Chunk)
+		profile.Output = redactBinding(profile.Output)
+		for laneID, lane := range profile.Artifacts {
+			lane.Extract = redactBinding(lane.Extract)
+			lane.Merge = redactBinding(lane.Merge)
+			lane.Normalize = redactBinding(lane.Normalize)
+			for i := range lane.Validators {
+				lane.Validators[i] = redactBinding(lane.Validators[i])
+			}
+			profile.Artifacts[laneID] = lane
+		}
+		cfg.Pipelines[id] = profile
+	}
+	return cfg
+}
+
+func redactBinding(binding pipeline.ModuleBinding) pipeline.ModuleBinding {
+	binding.Options = redactOptions(binding.Options)
+	for i := range binding.Validators.Validators {
+		binding.Validators.Validators[i] = redactBinding(binding.Validators.Validators[i])
+	}
+	return binding
+}
+
+func redactOptions(values map[string]any) map[string]any {
+	if len(values) == 0 {
+		return nil
+	}
+	out := make(map[string]any, len(values))
+	for key, value := range values {
+		if sensitiveConfigKey(key) {
+			out[key] = "[REDACTED]"
+			continue
+		}
+		switch typed := value.(type) {
+		case map[string]any:
+			out[key] = redactOptions(typed)
+		case []any:
+			items := make([]any, len(typed))
+			for i, item := range typed {
+				if nested, ok := item.(map[string]any); ok {
+					items[i] = redactOptions(nested)
+				} else {
+					items[i] = item
+				}
+			}
+			out[key] = items
+		default:
+			out[key] = value
+		}
+	}
+	return out
+}
+
+func sensitiveConfigKey(key string) bool {
+	key = strings.ToLower(key)
+	return strings.Contains(key, "api_key") || strings.Contains(key, "apikey") || strings.Contains(key, "authorization") || strings.Contains(key, "bearer") || strings.Contains(key, "password") || strings.Contains(key, "secret") || strings.Contains(key, "token")
+}