# Save as: my-config.yaml

# You can base your configuration on a preset and override specific options
# Or build from scratch by commenting out the parent line
#   parent: default

# ============================================================================
# Pattern Discovery - Automatically discover and redact sensitive values
# ============================================================================
# Discovery mode controls HOW discovery is performed (globally)
# Per-pattern settings (min_occurrences, case_sensitive, allowlist) are configured
# individually for each pattern type under strings.patterns
discovery:
  mode: default  # Options: none, fast, default (two-pass)

  # Property-based extraction - discover values from JFR event properties
  # Extracts values based on property key names (e.g., "user.name" -> extract username)
  # Supports two modes:
  #   1. Direct field matching: event.userName = "john" (matches field name "userName")
  #   2. Key-value pair matching: event.key = "user.name", event.value = "john"
  property_extractions:
  # Example: Extract usernames from properties like user.name, username, etc.
  # - name: "user_name_property"
  #   description: "Extract usernames from JFR event properties"
  #   key_pattern: "(?i)(user\\.name|username|user_name|user)"  # Regex to match property key
  #   key_property_pattern: "key"          # Property name for key in key-value pairs (default: "key")
  #   value_pattern: ".*"                  # Regex to match value content (default: ".*")
  #   value_property_pattern: "value"      # Property name for value in key-value pairs (default: "value")
  #   event_type_filter: ".*"              # Optional: only process specific event types (regex)
  #   type: USERNAME                       # USERNAME, HOSTNAME, EMAIL_LOCAL_PART, or CUSTOM
  #   case_sensitive: false                # Case sensitivity for discovered values
  #   min_occurrences: 1                   # Minimum occurrences to redact
  #   enabled: true

  # Example with custom key-value property names:
  # - name: "config_hostname"
  #   key_pattern: "server\\.host"
  #   key_property_pattern: "configKey"    # Custom property name for key
  #   value_property_pattern: "configValue"  # Custom property name for value
  #   type: HOSTNAME

  # Example with value pattern filtering:
  # - name: "corporate_emails"
  #   key_pattern: ".*email.*"
  #   value_pattern: ".*@company\\.com"    # Only extract @company.com emails
  #   type: EMAIL_LOCAL_PART

  # Note: Allowlists are handled by discovery_allowlist in strings.patterns
  # The property extractor respects the same allowlist as the pattern type

  # Custom extraction patterns - define your own patterns to discover
  # These are independent from strings.patterns and can extract any type of value
  custom_extractions:

  # Example 1: Extract usernames from SSH connection strings
  # - name: "ssh_usernames"
  #   description: "Extract usernames from SSH commands like 'user@hostname'"
  #   pattern: '([a-zA-Z0-9_-]+)@[a-zA-Z0-9.-]+'  # Captures username before @
  #   capture_group: 1         # Extract group 1 (the username)
  #   type: USERNAME           # Categorize as USERNAME (options: USERNAME, HOSTNAME, EMAIL_LOCAL_PART, CUSTOM)
  #   case_sensitive: false    # Treat "Alice", "alice", "ALICE" as same
  #   min_occurrences: 2       # Only redact if appears 2+ times
  #   allowlist:               # Never redact these usernames
  #     - root
  #     - admin
  #     - git
  #   enabled: true

  # Example 2: Extract build usernames from build logs
  # - name: "build_user"
  #   description: "Username from build info"
  #   pattern: 'built on .* by "([^"]+)"'
  #   capture_group: 1
  #   type: USERNAME
  #   case_sensitive: false
  #   min_occurrences: 1
  #   allowlist:
  #     - jenkins
  #   enabled: true

  # Example 3: Extract hostnames from URLs
  # - name: "url_hostnames"
  #   description: "Extract hostnames from HTTP/HTTPS URLs"
  #   pattern: 'https?://([a-zA-Z0-9.-]+)/'
  #   capture_group: 1
  #   type: HOSTNAME
  #   case_sensitive: false
  #   min_occurrences: 1
  #   allowlist:
  #     - localhost
  #     - example.com
  #   enabled: true

  # Example 4: Extract project codes (custom type)
  # - name: "project_codes"
  #   description: "Extract project identifiers like PROJ-ABC123"
  #   pattern: 'PROJ-([A-Z0-9]+)'
  #   capture_group: 1
  #   type: CUSTOM           # Will be categorized as custom
  #   case_sensitive: true   # Project codes are case-sensitive
  #   min_occurrences: 1
  #   enabled: true

# Property redaction - matches patterns in field names
properties:
  enabled: true
  case_sensitive: false  # If true, patterns are case-sensitive

  # Full match mode: if true, pattern must match entire field name
  # If false (default), pattern can match anywhere in field name
  # Example with pattern "password":
  #   full_match=false: matches "password", "user_password", "myPasswordField"
  #   full_match=true:  matches only "password" (exact match)
  full_match: false

  patterns:  # Regex patterns to match in field names
    - (pass(word|wort|wd)?|pwd)  # Matches: password, passwort, passwd, pwd
    - secret
    - token
    - (api[_-]?)?key       # Matches: key, api_key, api-key, apikey
    - auth
    - credential

    # - myapp_secret
    # - custom_token

# Event removal - completely remove these event types from the recording
events:
  remove_enabled: true
  removed_types:
    - jdk.OSInformation
    - jdk.SystemProcess
    - jdk.InitialEnvironmentVariable
    - jdk.ProcessStart
    # Add additional event types to remove:
    # - jdk.SystemProperty
    # - jdk.NativeLibrary

  # Advanced filtering (similar to jfr scrub command)
  # See: https://docs.oracle.com/en/java/javase/21/docs/specs/man/jfr.html
  # Filters are comma-separated lists and support glob patterns (* and ?)
  filtering:
    # Include only events matching these patterns (if specified, only matching events are kept)
    include_events: []
    # Examples:
    # - jdk.ThreadSleep,jdk.JavaMonitorWait  # Only these specific events
    # - jdk.*                                 # All JDK events
    # - my.app.*                              # All events from my.app package

    # Exclude events matching these patterns
    exclude_events: []
    # Examples:
    # - jdk.GCPhasePause*                    # Exclude all GC phase pause events
    # - jdk.ThreadSleep                      # Exclude thread sleep events

    # Include only events from these categories
    include_categories: []
    # Examples:
    # - Java Application                     # Only application events
    # - Java Virtual Machine                 # Only JVM events

    # Exclude events from these categories
    exclude_categories: []
    # Examples:
    # - Flight Recorder                      # Exclude JFR internal events

    # Include only events from these threads
    include_threads: []
    # Examples:
    # - main                                 # Only main thread
    # - worker-*                             # All worker threads

    # Exclude events from these threads
    exclude_threads: []
    # Examples:
    # - GC Thread*                           # Exclude all GC threads
    # - Service Thread                       # Exclude service thread

# String pattern redaction - redact matching patterns in string fields
strings:
  enabled: true

  # Normally you don't want to redact code artifacts
  redact_in_method_names: false
  redact_in_class_names: false
  redact_in_thread_names: false

  patterns:
    # Home directory paths - discovers usernames from paths
    home_directories:
      enabled: true

      # === Discovery Settings (per-pattern) ===

      # Enable pattern discovery: Extract usernames and redact them everywhere
      # If false, only the full path is redacted (e.g., "/Users/alice" redacted, but not standalone "alice")
      # If true, extracts "alice" and redacts it everywhere in the file
      discovery:
        enabled: true

        # Which regex capture group contains the value to extract (1 = first group)
        capture_group: 1

        # Minimum occurrences before a discovered value is redacted (prevents false positives)
        # Only values appearing at least this many times will be redacted
        min_occurrences: 1

        # Case sensitivity for discovered value matching
        # If false, "Alice", "alice", and "ALICE" are treated as the same value
        case_sensitive: false

        # Allowlist of values that should NEVER be discovered/redacted by this pattern
        # Useful for common/generic usernames
        allowlist:
          - root
          - admin
          - test
          - user
          - guest
          - system
          # Add pattern-specific safe values:
          # - jenkins
          # - builduser

      # Regex patterns for matching (with capture groups for extraction)
      patterns:
        - '/Users/([^/]+)'                    # macOS: /Users/username (group 1 = username)
        - 'C:\\Users\\([a-zA-Z0-9_\-]+)'     # Windows: C:\Users\username (group 1 = username)
        - '/home/[^/]+'                     # Linux: /home/username

    # Email addresses
    emails:
      enabled: true
      patterns:
        - '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'

    # UUIDs (often used as identifiers)
    uuids:
      enabled: false  # Set to true if UUIDs are sensitive in your context
      regex: '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}'

    # IP addresses
    ip_addresses:
      enabled: true
      patterns:
        - '\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b'
        - '\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b'

    # SSH host patterns - redact hostnames in SSH connection strings
    # Matches: user@hostname, ssh://hostname, hostname:port
    ssh_hosts:
      enabled: false  # Set to true if SSH hosts are sensitive
      patterns:
        - 'ssh://[a-zA-Z0-9.-]+'                           # ssh://hostname
        - '(?:ssh|sftp)://(?:[^@]+@)?[a-zA-Z0-9.-]+'      # ssh://user@hostname
        - '[a-zA-Z0-9_-]+@[a-zA-Z0-9.-]+(?::[0-9]+)?'     # user@host or user@host:port
        - '(?<=ssh\s)[a-zA-Z0-9_-]+@[a-zA-Z0-9.-]+'       # after "ssh " command

    # Custom patterns - add your own regex patterns here
    custom:
    # Example: AWS access keys (no discovery - just redact the pattern itself)
    # - name: aws_access_keys
    #   patterns:
    #     - 'AKIA[0-9A-Z]{16}'
    #   discovery:
    #     enabled: false  # Only redact "AKIA..." keys, don't extract parts

    # Example: Build IDs with discovery
    # - name: build_ids
    #   patterns:
    #     - 'build-([A-Z0-9]+)-\d+'  # e.g., build-ABC123-001
    #   discovery:
    #     enabled: true           # Extract "ABC123" and redact everywhere
    #     capture_group: 1        # Group 1 = the build code
    #
    #   # Optional: ignore certain values
    #   ignore_exact:
    #     - JENKINS  # Don't redact if the build code is "JENKINS"
    #
    #   # Optional: ignore patterns
    #   ignore:
    #     - 'TEST.*'  # Don't redact build codes starting with TEST

    # Example: JWT tokens (no discovery - just redact full tokens)
    # - name: jwt_tokens
    #   patterns:
    #     - 'eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+'
    #   discovery:
    #     enabled: false

# Network event redaction - redact addresses/ports in socket events
network:
  enabled: true
  redact_ports: true
  redact_addresses: true
  keep_local_addresses: false  # Set to true to preserve localhost/127.0.0.1
  event_types:
    - jdk.SocketRead
    - jdk.SocketWrite

# Path redaction - control how file paths are redacted
paths:
  enabled: true
  mode: keep_filename  # Options: keep_filename, redact_all, keep_all
  # keep_filename: /path/to/***/ and filename
  # redact_all: complete path becomes ***
  # keep_all: path unchanged
  fields:
    - path
    - directory
    - file
    - destination

# General settings
general:
  redaction_text: "***"  # Text to replace redacted values with

  # Partial redaction - show some info while hiding sensitive parts
  # When false: "my_secret_password" -> "***"
  # When true:  "my_secret_password" -> "my***" (shows prefix/suffix)
  # Useful for: debugging (identify which value without exposing it),
  #             compliance (show value format without actual data),
  #             log analysis (distinguish between different redacted values)
  partial_redaction: false

  # Pseudonymization - preserves relationships between values
  # When enabled, the same input value always maps to the same redacted output
  # e.g., "user@example.com" -> "<redacted:a1b2c3>" (consistent across the recording)
  pseudonymization:
    enabled: false  # Set to true to enable pseudonymization

    # Pseudonymization mode:
    # - "hash": Hash-based (stateless, deterministic, default)
    #           No state required, same value always produces same hash
    #           Best for: Most use cases, low memory, deterministic
    # - "counter": Simple counter (stateful, requires hash map)
    #              Maps values to sequential numbers: value1->1, value2->2
    #              Best for: Debugging, smaller output, when you want readable IDs
    # - "realistic": Generates plausible-looking alternatives (stateful)
    #                Replaces sensitive data with realistic alternatives
    #                Examples: "john.doe@company.com" -> "alice.smith@test.com"
    #                          "/home/johndoe" -> "/home/user01"
    #                          "johndoe" -> "user01"
    #                Best for: Creating shareable test data, demos, public bug reports
    mode: "hash"

    format: "redacted"  # Options: "redacted", "hash", "custom"
    # - redacted: <redacted:abc123>
    # - hash: <hash:abc123>
    # - custom: use custom_prefix and custom_suffix
    custom_prefix: "<redacted:"  # Used when format is "custom"
    custom_suffix: ">"
    hash_length: 8  # Length of hash suffix (6-32), only for mode="hash"
    hash_algorithm: "SHA-256"  # Options: SHA-256, SHA-1, MD5, only for mode="hash"

    # Scope of pseudonymization - what types of redacted values to pseudonymize
    scope:
      properties: true      # Property values (passwords, tokens, etc.)
      strings: true         # String pattern matches (emails, IPs, etc.)
      network: true         # Network addresses
      paths: true           # File paths
      ports: true           # Port numbers (always uses counter, mapped to 1000+ range)
      # Example: port 8080 -> 1001, port 443 -> 1002

    # Custom replacements for specific values (highest priority, overrides all modes)
    # Map exact values to specific replacements
    # Useful for replacing known usernames, email addresses, or paths
    replacements:
    # Example username replacements:
    # "johndoe": "alice"
    # "admin": "user01"

    # Example email replacements:
    # "john.doe@company.com": "user@example.com"
    # "admin@internal.net": "contact@test.org"

    # Example path replacements:
    # "/home/johndoe": "/home/testuser"
    # "C:\\Users\\JohnDoe": "C:\\Users\\TestUser"
    # "/Users/johndoe": "/Users/testuser"

    # Pattern-based replacement generators (using RgxGen)
    # Define regex patterns for generating realistic replacements by pattern type
    #
    # Two modes of operation:
    # 1. Redaction mode (pseudonymization disabled):
    #    - Generates a random value from the pattern each time
    #    - Used for simple redaction with ***
    #    - Example: "user42" -> "user73" (random each time)
    #
    # 2. Pseudonymization mode (pseudonymization enabled):
    #    - Generates consistent deterministic mappings
    #    - Same input always produces same output
    #    - Example: "user42" -> "user17" (always the same)
    #    - Warns if pattern has too few possible values (<100 recommended)
    #
    # ============================================================================
    # IMPORTANT: Special placeholders
    # ============================================================================
    #
    # Special placeholders are automatically replaced with realistic data:
    #   {users}  - Realistic user folder names (alice, bob, charlie, diana, etc.)
    #   {emails} - Realistic email addresses (alice.smith@example.com, etc.)
    #   {names}  - Realistic usernames (alice.smith, bob.jones, etc.)
    #
    # These placeholders are replaced with equivalent regex patterns before
    # regex generation, so they work seamlessly with any regex pattern.
    #
    # YAML ESCAPING RULES (for regex special characters):
    # In YAML strings, backslash is an escape character, so:
    #   - To match a literal dot (.):     use \\. in YAML (becomes \. in regex)
    #   - To match a literal backslash:   use \\\\ in YAML (becomes \\ in regex)
    #
    # EXAMPLES:
    #   Unix home with placeholder:
    #     "/home/{users}"               → generates "/home/alice"
    #
    #   Windows home with placeholder:
    #     "C:\\\\Users\\\\{users}"      → generates "C:\Users\alice"
    #     Note: \\\\ in YAML becomes \\ in regex (matches single backslash)
    #
    #   Email domain:
    #     "[a-z]+@example\\.com"        → generates "user@example.com"
    #     (\\. becomes \. in regex, matches literal dot)
    #
    #   IP addresses:
    #     "10\\.0\\.[0-9]{1,3}\\.[0-9]{1,3}"  → generates "10.0.123.45"
    #
    #   Mixed path and placeholder:
    #     "/data/{users}/files"         → generates "/data/bob/files"
    #
    #   Multiple placeholders:
    #     "/home/{users} owned by {names}"  → generates "/home/alice owned by bob.smith"
    #
    #   Server logs with pattern and placeholder:
    #     "srv[0-9]{2}/{users}/app\\.log"   → generates "srv42/charlie/app.log"
    #
    # ============================================================================
    pattern_generators:
    # SSH host patterns - generates hostnames matching the regex
    # "ssh_hosts": "host[0-9]{2}\\.example\\.com"

    # IP address patterns - generates IP addresses in specific ranges
    # "ip_addresses": "10\\.0\\.[0-9]{1,3}\\.[0-9]{1,3}"
    # "ipv4_private": "192\\.168\\.[0-9]{1,3}\\.[0-9]{1,3}"

    # Username patterns - generates consistent usernames
    # "usernames": "user[0-9]{3}"
    # "service_accounts": "svc_[a-z]{4}[0-9]{2}"

    # User path patterns with {users} placeholder
    # "unix_home": "/home/{users}"
    # "mac_home": "/Users/{users}"
    # "win_home": "C:\\\\Users\\\\{users}"

    # Temporary file patterns
    # "temp_files": "temp_[a-z0-9]{8}"
    # "session_ids": "[a-f0-9]{32}"

    # Email patterns with placeholder
    # "user_emails": "{emails}"
    # "internal_emails": "[a-z]{5}\\.[a-z]{5}@internal\\.example\\.com"

    # Custom application-specific patterns
    # "app_tokens": "tok_[A-Za-z0-9]{16}"
    # "customer_ids": "CUST[0-9]{8}"

# Usage examples:
#
# Use this custom config:
#   java -jar jfr-redact.jar input.jfr output.jfr --config my-config.yaml
#
# Start with a preset and override:
#   java -jar jfr-redact.jar input.jfr output.jfr --preset strict --keep-local-addresses
#
# Enable pseudonymization to preserve relationships:
#   java -jar jfr-redact.jar input.jfr output.jfr --config my-config.yaml --pseudonymize
#
# Use pseudonymization with custom format:
#   java -jar jfr-redact.jar input.jfr output.jfr --pseudonymize --pseudonym-format hash
#
# Test without creating output:
#   java -jar jfr-redact.jar input.jfr output.jfr --config my-config.yaml --dry-run --verbose