Harden CLI lane filtering and diagnostics redaction

internal/core/config/redaction.go

@@ -1,5 +1,7 @@
 package config
 
+import "gitea.maximumdirect.net/eric/notarius/internal/framework/pipeline"
+
 const redactedSecret = "[REDACTED]"
 
 func (c Config) Redacted() Config {
@@ -12,3 +14,44 @@ func (c Config) Redacted() Config {
 	}
 	return redacted
 }
+
+func (c Config) RedactedDiagnosticsPayload() any {
+	return c.Redacted()
+}
+
+func (e EffectiveConfig) RedactedDiagnosticsPayload() any {
+	return EffectiveConfig{
+		Config:           e.Config.Redacted(),
+		PipelineID:       e.PipelineID,
+		Only:             append([]string(nil), e.Only...),
+		ResolvedPipeline: cloneResolvedPipeline(e.ResolvedPipeline),
+	}
+}
+
+func cloneResolvedPipeline(in pipeline.ResolvedPipeline) pipeline.ResolvedPipeline {
+	out := in
+	out.Input = cloneModuleBinding(in.Input)
+	out.Chunk = cloneModuleBinding(in.Chunk)
+	out.Output = cloneModuleBinding(in.Output)
+	if len(in.ArtifactLanes) > 0 {
+		out.ArtifactLanes = make([]pipeline.ResolvedArtifactLane, len(in.ArtifactLanes))
+		for i, lane := range in.ArtifactLanes {
+			out.ArtifactLanes[i] = cloneResolvedArtifactLane(lane)
+		}
+	}
+	return out
+}
+
+func cloneResolvedArtifactLane(in pipeline.ResolvedArtifactLane) pipeline.ResolvedArtifactLane {
+	out := in
+	out.Extract = cloneModuleBinding(in.Extract)
+	out.Merge = cloneModuleBinding(in.Merge)
+	out.Normalize = cloneModuleBinding(in.Normalize)
+	if len(in.Validators) > 0 {
+		out.Validators = make([]pipeline.ModuleBinding, len(in.Validators))
+		for i, binding := range in.Validators {
+			out.Validators[i] = cloneModuleBinding(binding)
+		}
+	}
+	return out
+}

internal/core/config/redaction_test.go

@@ -35,3 +35,67 @@ func TestRedactedConfigRemovesAPIKeyValues(t *testing.T) {
 		t.Fatalf("redaction mutated original config")
 	}
 }
+
+func TestConfigRedactedDiagnosticsPayloadRedactsAPIKeys(t *testing.T) {
+	cfg := Default()
+	profile := cfg.LLMProfiles[pipeline.DefaultLLMProfile]
+	profile.APIKey = "secret"
+	profile.Model = "test-model"
+	cfg.LLMProfiles[pipeline.DefaultLLMProfile] = profile
+
+	payload, ok := cfg.RedactedDiagnosticsPayload().(Config)
+	if !ok {
+		t.Fatalf("expected Config payload, got %T", cfg.RedactedDiagnosticsPayload())
+	}
+	if payload.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != redactedSecret {
+		t.Fatalf("expected API key redacted, got %+v", payload.LLMProfiles[pipeline.DefaultLLMProfile])
+	}
+	if payload.LLMProfiles[pipeline.DefaultLLMProfile].Model != "test-model" {
+		t.Fatalf("expected non-secret fields preserved, got %+v", payload.LLMProfiles[pipeline.DefaultLLMProfile])
+	}
+	if cfg.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != "secret" {
+		t.Fatalf("redacted diagnostics payload mutated original config")
+	}
+}
+
+func TestEffectiveConfigRedactedDiagnosticsPayloadRedactsAndCopies(t *testing.T) {
+	cfg := validConfig()
+	profile := cfg.LLMProfiles[pipeline.DefaultLLMProfile]
+	profile.APIKey = "secret"
+	cfg.LLMProfiles[pipeline.DefaultLLMProfile] = profile
+	lane := cfg.Pipelines["example"].Artifacts["events"]
+	lane.Extract.Options = map[string]any{"temperature": 0.2}
+	cfg.Pipelines["example"].Artifacts["events"] = lane
+
+	effective, err := cfg.Resolve(ResolveInput{
+		PipelineID: "example",
+		Only:       []string{"events"},
+		Catalog:    fakeCatalog(t),
+	})
+	if err != nil {
+		t.Fatalf("Resolve: %v", err)
+	}
+
+	payload, ok := effective.RedactedDiagnosticsPayload().(EffectiveConfig)
+	if !ok {
+		t.Fatalf("expected EffectiveConfig payload, got %T", effective.RedactedDiagnosticsPayload())
+	}
+	if payload.Config.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != redactedSecret {
+		t.Fatalf("expected nested API key redacted, got %+v", payload.Config.LLMProfiles[pipeline.DefaultLLMProfile])
+	}
+	if cfg.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != "secret" {
+		t.Fatalf("redacted diagnostics payload mutated source config")
+	}
+	if payload.PipelineID != effective.PipelineID || payload.ResolvedPipeline.Digest != effective.ResolvedPipeline.Digest {
+		t.Fatalf("expected pipeline metadata preserved, got %+v", payload)
+	}
+
+	payload.Only[0] = "changed"
+	if effective.Only[0] != "events" {
+		t.Fatalf("expected only lanes to be copied")
+	}
+	payload.ResolvedPipeline.ArtifactLanes[0].Extract.Options["temperature"] = 1.0
+	if effective.ResolvedPipeline.ArtifactLanes[0].Extract.Options["temperature"] != 0.2 {
+		t.Fatalf("expected resolved pipeline options to be copied")
+	}
+}