Class SecretHeaderReplacer

java.lang.Object

com.shaft.capture.network.SecretHeaderReplacer

public final class SecretHeaderReplacer
extends Object

Replaces sensitive header values with deterministic secret-ref tokens, optionally storing raw values in a git-ignored .secrets.json file with owner-only permissions.

Constructor Summary

Constructors

Constructor	Description
SecretHeaderReplacer()

Method Summary

Modifier and Type	Method	Description
Map<String,String>	replaceSecrets(Map<String,String> headers, String sessionId)	Replaces every sensitive header value with a secret-ref token.
Map<String,String>	replaceSecrets(Map<String,String> headers, String sessionId, Path sessionDir, boolean storeSecretsLocally)	Replaces sensitive headers and optionally writes raw secrets to .secrets.json.

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SecretHeaderReplacer

public SecretHeaderReplacer()

Method Details

replaceSecrets

public Map<String,String> replaceSecrets(Map<String,String> headers,
 String sessionId)

Replaces every sensitive header value with a secret-ref token. The raw value is never present in the returned map. ENV_NAME derivation is deterministic and collision-safe for the same session.

Parameters:

headers - original headers map (may be null)

sessionId - unique session identifier for collision-safe ENV_NAME derivation

Returns:

new map with sensitive values replaced by secret-ref tokens, or null if input is null

replaceSecrets

public Map<String,String> replaceSecrets(Map<String,String> headers,
 String sessionId,
 Path sessionDir,
 boolean storeSecretsLocally)

Replaces sensitive headers and optionally writes raw secrets to .secrets.json.

Parameters:

headers - original headers map (may be null)

sessionId - unique session identifier for collision-safe ENV_NAME derivation

sessionDir - directory where .secrets.json will be written

storeSecretsLocally - if true, write raw secrets to .secrets.json with owner-only permissions

Returns:

new map with sensitive values replaced by secret-ref tokens, or null if input is null

Throws:

CaptureFormatException - if secrets file write fails