Skip to content

feat: move redaction timing to before job enqueue in record! (#47) #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dpaluy wants to merge 6 commits into
base: master
Choose a base branch
from
Open

feat: move redaction timing to before job enqueue in record! (#47) #57

dpaluy wants to merge 6 commits into from

Conversation

@dpaluy
Copy link
Owner

@dpaluy dpaluy commented Jan 7, 2026

Summary

Critical security fix: Apply PII redaction BEFORE job enqueue to ensure raw PII never enters the job queue (Redis/Sidekiq/SQS).

  • record! now calls apply_redaction() before PersistInteractionJob.perform_later
  • apply_redaction() serializes actor and runs RedactionPipeline inline
  • RedactionAudit excluded from job payload (not ActiveJob serializable)
  • PersistInteractionJob uses assign_actor() for serialized actor data
  • Added comprehensive tests for redaction timing and actor serialization

Test plan

  • Test verifies PII is redacted before job enqueue
  • Test verifies no raw PII in persisted data
  • Test verifies actor serialization for job-safe persistence
  • Performance test confirms redaction is under 100ms for large payloads
  • Full test suite passes (171 tests)

Closes #47

dpaluy added 6 commits January 6, 2026 23:00
@dpaluy
refactor: remove legacy redaction system in preparation for pattern-b…
35b7c0c 
…ased refactor

Remove dual-layer PII redaction system (database rules + class-based redactors) to prepare for new unified pattern-based architecture.

Deleted:
- RedactionRule model and migration (database-backed rules)
- Base, Email, Phone, CardPAN redactor classes
- Related tests for legacy system

Modified:
- RedactionPipeline: removed apply_database_rules! method
- Config: default_redactors now returns [] with TODO comment
- Tests: updated to use custom_redactors instead of built-in ones

Breaking change: No redactors active until new Pattern system is implemented (T1-T3).
Tests pass: 123 runs, 368 assertions, 0 failures

Related: #38-#54 (PII Redaction Architecture Refactor)
@dpaluy
feat: Create RedactionAudit value object for PII auditing
b4b99ba 
Implements immutable value object for tracking PII redaction operations,
supporting GDPR/CCPA compliance requirements (Spec Gap 9).

Key features:
- Immutable instances with builder pattern methods
- Tracks redaction metadata: timestamp, redactors applied, fields, counts
- LLM redaction status tracking (success, failed, skipped)
- Methods: record_redaction, record_llm_failure, record_llm_success, to_h
- Deduplicates and sorts redactor names
- Compact JSON serialization via to_h

Comprehensive test suite (22 tests):
- Default initialization and timestamp handling
- Redaction recording and deduplication
- Immutability verification
- LLM status transitions
- Hash serialization with nil filtering
- Complex nested scenarios and chaining

Next: Integrate with RedactionPipeline and NormalizedInteraction
@dpaluy
feat: add serialize_actor method to TraceBook module
016fb6c 
Add public method to convert ActiveRecord actors to job-safe serialized
format for background job enqueueing. Supports GlobalID extraction with
fallback to type/id tuple for objects without GlobalID support.

Closes #42
@dpaluy
feat: add config DSL methods for PII redaction (T7 #44)
86eac0c 
Add pattern-based redaction DSL to Config class:
- config.redact :email, :phone - enables individual patterns
- config.redact_group :api_keys - enables pattern groups
- config.redact_pattern(/regex/, "[REPLACEMENT]") - custom patterns
- config.active_patterns - returns all enabled Pattern objects

Also includes:
- T2: Validators module with Luhn and SSN range validation
- T3: PATTERNS hash with 16 built-in patterns (email, phone, credit_card,
  ssn, openai_key, anthropic_key, aws_key, stripe_key, github_token,
  github_pat, bearer_token, basic_auth, private_key, ipv4, ipv6, jwt)
- PATTERN_GROUPS for convenient batch enabling (pii, financial, api_keys,
  auth, network, crypto)

Invalid pattern names raise ConfigurationError at config time for
early validation.
@dpaluy
feat: add legacy lambda wrapper to RedactionPipeline (T8 #45)
f8c02d6 
Update RedactionPipeline to support both interface styles:
- New Pattern-based: call(text, audit:, field_path:) returns [text, audit]
- Legacy lambda: call(text) returns text

The pipeline auto-detects which interface to use:
- Pattern objects are detected by class check
- Lambdas with `audit:` keyword param bypass wrapping
- Legacy single-arg lambdas get wrapped with audit tracking

Also includes:
- NormalizedInteraction extended with actor_type, actor_id, actor_gid,
  redaction_audit fields (T4 dependencies)
- Patterns applied first, then custom_redactors
- RedactionAudit populated on result.redaction_audit

Backwards compatible with existing custom_redactors configuration.
@dpaluy
feat: move redaction timing to before job enqueue in record! (#47)
8a1f1b0 
Critical security fix: Apply PII redaction BEFORE job enqueue to ensure
raw PII never enters the job queue (Redis/Sidekiq/SQS).

Changes:
- record! now calls apply_redaction() before PersistInteractionJob.perform_later
- apply_redaction() serializes actor and runs RedactionPipeline inline
- RedactionAudit excluded from job payload (not ActiveJob serializable)
- PersistInteractionJob uses assign_actor() for serialized actor data
- Added comprehensive tests for redaction timing and actor serialization
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

T10: Move redaction timing to before job enqueue in record!

2 participants

@dpaluy