Renders a request in a form that is safe to show a human.
Every URI that reaches a com.worxbend.codeberg4s.CallContext, and therefore every URI that can appear in an error message, a telemetry callback or an application's log, comes from here. That makes this object a security boundary rather than a formatting helper: if a credential can survive Redaction.uri, it can reach a log file.
Forgejo accepts a token as a query parameter as well as in a header. This library never sends one that way, but a caller can add an arbitrary query parameter, so the sensitive names are masked on the way out regardless.
Masks the value of every credential-carrying header, keeping order and every other header untouched.
Masks the value of every credential-carrying header, keeping order and every other header untouched.
Nothing in this library puts an Authorization header into a CodebergRequest — the transport adds it — but a telemetry implementation that wants to show the headers it sent goes through here first.
Renders a request URI with every component percent-encoded and every credential masked.
Renders a request URI with every component percent-encoded and every credential masked.
Path segments and query values are encoded per RFC 3986: only A-Z, a-z, 0-9, -, ., _ and ~ survive literally, everything else becomes the uppercase percent-encoding of its UTF-8 bytes. A segment containing / therefore cannot forge a path even if a validated identifier ever let one through.
The value of a parameter named in SensitiveQueryParameters is replaced by Mask and never encoded, so the result shows ?token=*** rather than an encoded secret.
The base URI is not trusted to be clean. com.worxbend.codeberg4s.BaseUri.from rejects one carrying user:password@, a query or a fragment, but this method takes a plain String and a test fake can pass anything at all, so those three parts are removed here as well. Without that, a password in a hand-built base URI would be copied into every rendered URI, and therefore into every error and every telemetry event.
Value parameters
baseUri
the API root, expected to be normalised without a trailing slash
path
unencoded path segments, in order; an empty list renders just the base URI