001/*
002 * Copyright 2015-2022 Transmogrify LLC, 2022-2026 Revetware LLC.
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License");
005 * you may not use this file except in compliance with the License.
006 * You may obtain a copy of the License at
007 *
008 * http://www.apache.org/licenses/LICENSE-2.0
009 *
010 * Unless required by applicable law or agreed to in writing, software
011 * distributed under the License is distributed on an "AS IS" BASIS,
012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 * See the License for the specific language governing permissions and
014 * limitations under the License.
015 */
016
017package com.pyranid;
018
019import org.jspecify.annotations.NonNull;
020
021import javax.annotation.concurrent.ThreadSafe;
022import java.util.Optional;
023
024/**
025 * Wraps a bound parameter value so Pyranid can mask it in diagnostics while still binding the underlying value normally.
026 * <p>
027 * This is display-only: it does not change what is bound to the database. Pyranid's own diagnostic rendering reads
028 * {@link #getMask()} directly and does not rely on an implementation's {@link Object#toString()} method.
029 * <p>
030 * <strong>Scope and limits.</strong> Because the real value is bound to the {@link java.sql.PreparedStatement},
031 * the database driver may echo it back in its own error text (for example, PostgreSQL constraint violations include
032 * {@code Key (email)=(...) already exists}). As of 4.5.0, Pyranid additionally performs a best-effort scrub of
033 * verbatim occurrences of secure values from the {@link DatabaseException} message, its DBMS metadata fields, and
034 * {@link StatementLog} diagnostics. The scrub is verbatim-only: values the driver transforms before echoing
035 * (re-formatted numbers or temporals, truncated strings, encoded bytes) are not caught, and very short values are
036 * skipped to avoid corrupting unrelated diagnostics. The scrub applies to exceptions raised during statement
037 * execution; exceptions raised outside a statement context - commit/rollback time (e.g. deferred constraint
038 * violations), connection acquisition, raw-connection operations - are not scrubbed. <strong>The raw driver
039 * exception is deliberately preserved as
040 * the {@link Throwable#getCause() cause} and is never sanitized</strong> - any sink that renders the stack trace or
041 * walks the cause chain (log appenders, error trackers such as Sentry, OpenTelemetry exception events) can still
042 * observe the raw value. Treat the cause chain as sensitive.
043 * <p>
044 * Implementations should be threadsafe.
045 *
046 * @author <a href="https://www.revetkn.com">Mark Allen</a>
047 * @since 4.4.0
048 */
049@ThreadSafe
050public interface SecureParameter {
051        /**
052         * Gets the value to bind.
053         *
054         * @return the value to bind, or {@link Optional#empty()} if the value is {@code null}
055         */
056        @NonNull
057        Optional<Object> getValue();
058
059        /**
060         * Gets the safe display value Pyranid should render in diagnostics.
061         *
062         * @return the safe display value
063         */
064        @NonNull
065        String getMask();
066}