Repository navigation
refactor: take the scanners out of the proxy, and drop a vendored rule file - #105
Merged
Merged
Conversation
…e file Three things were welded together that should not have been. The proxy depended on both scanner crates unconditionally. A deployment wanting neither compiled both, and one wanting a scanner this repository has never heard of had to remove these first. They are optional features now, and the proxy builds and runs with no scanner at all — CI builds that combination and each feature alone, because a `use` added outside a cfg compiles fine with defaults on and breaks only for the person building without them, who is exactly the person least able to report it. The pii-kr adapter lived inside the proxy. That made the proxy the only thing able to use it. It could not move into pasu-pii-kr either, because that crate depends on no pasu crate and that is precisely what lets a gateway which has never heard of pasu use the scanner. So it is its own crate, and both sides stay free: the scanner dependency-free, the adapter available to any host. redact::Policy was proxy-local. What a finding means — refuse, or replace — is the same question wherever an inspector runs, and a second host answering it separately is the drift a security tool cannot afford. It is in pasu-core. Separately: tests/fixtures held example_recognizers.yaml copied verbatim out of another project. Reading a published format is reference; carrying another project's file is not, and a test fixture is not an exception to that. It is replaced by one written here, chosen for the cases the importer has to survive rather than for realism — a weak pattern, a deny list, an ordinary pattern in one document, where a partial failure has somewhere to hide. docs/adapting.md says what the seams are and what to implement on each, since a structure nobody can find their way into is not adaptable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three things were welded together that should not have been, and one file did not belong in the repository.
The proxy compiled scanners nobody asked for
pasu-proxydepended on both scanner crates unconditionally. A deployment wanting neither compiled both; one wanting a scanner this repository has never heard of had to remove these first.They are optional features now, and the proxy builds and runs with no scanner at all:
CI builds that combination and each feature alone. A
useadded outside acfgcompiles fine with defaults on and breaks only for the person building without them — who is exactly the person least able to report it.The adapter was trapped in the proxy
The pii-kr adapter lived in
pasu-proxy, which made the proxy the only thing able to use it.It could not simply move into
pasu-pii-kreither: that crate depends on no pasu crate, and that is precisely what lets a gateway which has never heard of pasu use the scanner. So the adapter is its own crate, and both sides stay free — the scanner dependency-free, the adapter available to any host.The policy was proxy-local
redact::Policyis now inpasu-core. What a finding means — refuse, or replace — is the same question wherever an inspector runs, and a second host answering it separately is the drift a security tool cannot afford.A vendored rule file
tests/fixtures/heldexample_recognizers.yamlcopied verbatim out of another project. Reading a published format is reference; carrying another project's file is not, and a test fixture is not an exception to that.Replaced by one written here, chosen for the cases the importer has to survive rather than for realism — a weak pattern, a deny list and an ordinary pattern in one document, where a partial failure has somewhere to hide.
docs/adapting.md
A structure nobody can find their way into is not adaptable. It maps the seams, says which trait to implement for what, and states the two non-negotiable rules for an inspector: every occurrence rather than the first, and a
Findingthat never carries the matched value.🤖 Generated with Claude Code