finprint.redact

module finprint

Privacy rules for what goes into a recipe (blueprint section 4).

• Argument values whose parameter name (or mapping key) looks secret (token, password, secret, key, credential, auth…) become "<redacted>". pandas’ own key/keys parameters are exempt only where the called pandas function really has such a parameter (sort_values(key=), set_index(keys)).
• Secrets and row values recognisable by their shape are cut out of any string argument: Bearer tokens, access_token= and similar query parameters, passwords in SQL or connection strings, URL user info, known key prefixes (sk_live_, ghp_, AKIA…), JSON web tokens and email addresses. The step is then marked not replayable, because the recorded value is no longer the real one.
• String values longer than 200 characters are kept as their length, their sha256 and a short prefix, and the prefix is dropped when it looks secret.
• Absolute paths are cut to their basename (the directory can hold a user name): bare paths, file:// URIs, Windows drive and UNC paths, and home-directory paths inside longer strings.
• Cell source and step code are kept as written (replay and the narrative need them); scan_text finds email addresses, key-like literals, secret-looking assignments, Bearer headers, token query parameters, long hex keys, absolute home paths and very long literals, so rec.save can warn and suggest cells=False.

Classes

Finding

class

class Finding

Fields

Name	Type	Default	Description
where	str
kind	str

Methods and properties (1)

init constructor

Finding(self, where: str, kind: str) -> None

Source: packages/finprint/src/finprint/redact.py, line 119

Functions

is_secret_name

function

def is_secret_name(name: str | None) -> bool

Source: packages/finprint/src/finprint/redact.py, line 55

truncate

function

def truncate(s: str) -> dict[str, object]

A long string as its length, sha256 and a short prefix (dropped when the prefix itself looks secret).

Source: packages/finprint/src/finprint/redact.py, line 64

strip_path

function

def strip_path(s: str) -> str

Basename for an absolute path, ~ path, file:// URI or Windows path; home paths inside text cut too.

Source: packages/finprint/src/finprint/redact.py, line 73

source_label

function

def source_label(path: str) -> str

A safe input name for a reader argument: a URL loses its scheme, user info, query and fragment.

Source: packages/finprint/src/finprint/redact.py, line 87

redact_text

function

def redact_text(s: str) -> tuple[str, list[str]]

s with secrets and email addresses recognisable by their shape replaced, and what was replaced.

Source: packages/finprint/src/finprint/redact.py, line 96

scan_text

function

def scan_text(text: str, where: str) -> list[Finding]

Email addresses, secrets, absolute home paths and very long literals in a cell, a step’s code or its args.

Source: packages/finprint/src/finprint/redact.py, line 139

Constants

Name	Type	Value	Description
SECRET_NAME		re.compile('token|passw|pwd|secret|key|credential|creds|auth(?!or)|bearer|coo...
MAX_LITERAL		200
PREFIX_LEN		24
REDACTED		'<redacted>'
EMAIL		re.compile('[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\\.[A-Za-z0-9-]+)*\\.[A-Za-z]{2...