Module redact 

One redaction, driven by the schema.

A value a client sent is stored on the execution, published in execution.created, rendered in the Cockpit and printed by the command line. That is four places a secret could leak from, so it is removed once — here, before the value is stored — and every consumer downstream is reading an already-safe value rather than remembering to be careful.

What counts as sensitive is the input type’s own schema, never a guess from a field’s name: format: "password", writeOnly: true, or the explicit x-majordomus-sensitive: true extension. A Rust type declares it where it declares everything else a projection reads:

/// Credentials for a provider.
#[derive(JsonSchema)]
struct Credentials {
    /// Who.
    user: String,
    /// The secret; never stored, never published, never logged.
    #[schemars(extend("format" = "password"))]
    token: String,
}

Constants

REDACTED

What a sensitive value is replaced with. A marker rather than an empty string, so that a reader can tell “withheld” from “not given”.

Functions

redact

The input as it may be stored: every value the schema marks sensitive replaced.