Class DoctorRedactor

java.lang.Object
com.shaft.doctor.internal.DoctorRedactor
public final class DoctorRedactor extends Object
Structured and textual deterministic redaction for Doctor evidence.

  • Constructor Details

    • DoctorRedactor

      public DoctorRedactor()

  • Method Details

    • redact

      public tools.jackson.databind.JsonNode redact(tools.jackson.databind.JsonNode input)
      Redacts a JSON tree without retaining removed values.
      Parameters:
      input - input tree
      Returns:
      sanitized copy

    • redact

      public String redact(String input)
      Redacts textual evidence.
      Parameters:
      input - input text
      Returns:
      sanitized text

    • appliedRules

      public List<String> appliedRules()
      Returns sorted applied rule names.
      Returns:
      applied rules

    • removedFields

      public List<String> removedFields()
      Returns sorted removed structured field names.
      Returns:
      removed field names

    • extractSensitiveRegions

      public List<String> extractSensitiveRegions(String htmlContent)
      Determines if HTML page snapshot indicates sensitive fields requiring screenshot masking. Returns empty list if no sensitive fields found, or a special marker indicating whole-image masking. Since jsoup parses static HTML (not rendered layout), real pixel coordinates are not derivable. This method adopts a conservative approach: when sensitive input fields are detected, it returns a marker indicating full-image masking rather than fake precise regions.
      Parameters:
      htmlContent - HTML page snapshot content
      Returns:
      empty list if no sensitive fields, or list with single marker element for whole-image masking

    • redactScreenshot

      public byte[] redactScreenshot(byte[] screenshotBytes, List<String> regions) throws IOException
      Applies full-image opaque masking to screenshot bytes when sensitive regions are detected. Only masks if regions list contains the whole-image marker.

      Redaction fails closed: if the sensitive regions marker is present but the image cannot be re-encoded after masking, this method throws rather than returning the original, still-sensitive bytes, since silently falling back would leak unredacted evidence.

      Parameters:
      screenshotBytes - original screenshot image bytes
      regions - masking decision (empty = no masking, contains the whole-image marker = mask entire image)
      Returns:
      masked image bytes, or original bytes if no masking needed or the bytes are not a decodable image
      Throws:
      IOException - if a decodable image was masked but could not be re-encoded