nebius.base.token_sanitizer

module documentation
(source)

Remove sensitive parts from tokens.

This module masks signatures and other sensitive token parts. It keeps useful nonsensitive parts visible. It supports Nebius IAM tokens and JWT tokens. Token-version definitions specify prefixes, delimiters, and signature positions.

Class DefaultTokenVersionExtractor Identify token versions from a predefined mapping.
Class TokenSanitizer Mask sensitive token parts according to the token version.
Class TokenVersion Describe the structure of a token version.
Class TokenVersionExtractor Define the interface that identifies a token version.
Function sanitize_no_signature Limit the visible payload of a token that has no signature.
Function sanitize_unrecognized Limit the visible part of an unrecognized token.
Constant ACCESS_TOKEN_VERSIONS Supported access-token formats.
Constant CREDENTIALS_VERSIONS Supported credential formats.
Constant MASK_STRING The mask printed instead of sensitive parts of tokens.
Constant MAX_VISIBLE_PAYLOAD_LENGTH Maximum length of visible payload before masking.
Constant NO_SIGNATURE Constant indicating no signature position in the token.
def sanitize_no_signature(token: str, prefix: str) -> str: (source)

Limit the visible payload of a token that has no signature.

Return the complete token if its payload is not too long. Otherwise, replace the end of the payload with MASK_STRING.

Parameters
token:strThe full token string.
prefix:strThe prefix of the token version.
Returns
strThe sanitized token.
def sanitize_unrecognized(token: str) -> str: (source)

Limit the visible part of an unrecognized token.

Show the first part of the token and mask the remaining part.

Parameters
token:strThe token string to sanitize.
Returns
strThe sanitized token.
ACCESS_TOKEN_VERSIONS: dict[str, TokenVersion] = (source)

Supported access-token formats.

The keys are version names. The values describe each format.

Value
{'V0': TokenVersion(prefix='v0.',
                    delimiter='.',
                    signature_position=NO_SIGNATURE,
                    token_parts_count=1),
 'NE1': TokenVersion(prefix='ne1',
                     delimiter='.',
                     signature_position=1,
...
CREDENTIALS_VERSIONS: dict[str, TokenVersion] = (source)

Supported credential formats.

The mapping contains all access-token formats, DE1, and JWT.

Value
{**ACCESS_TOKEN_VERSIONS,
 'DE1': TokenVersion(prefix='nd1',
                     delimiter='.',
                     signature_position=1,
                     token_parts_count=2),
 'JWT': TokenVersion(prefix='eyJ',
                     delimiter='.',
...
MASK_STRING: str = (source)

The mask printed instead of sensitive parts of tokens.

Value
'**'
MAX_VISIBLE_PAYLOAD_LENGTH: int = (source)

Maximum length of visible payload before masking.

Value
15
NO_SIGNATURE: int = (source)

Constant indicating no signature position in the token.

Value
-1