mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-28 20:21:50 +01:00
nickyleachandPaperclip
f3144b17ca
The redaction registry only replaced the exact stored value of a run's own registrations. A bearer minted on one run and pasted into another run's or issue's text stayed unmasked, and a row swept clear of its material could no longer resolve any plain text to match against. Add a second pass to the three read functions. It finds each JWT-shaped candidate in the value, hashes it, and checks the hash against the company's registry. A match needs no decryption, because the candidate found in the text already is the plain text, so a row whose material the sweep cleared still masks. The lookup scopes to the company only, so it also covers a value pasted across runs and issues. It batches its query over the whole candidate set instead of querying once per run or per candidate. Co-authored-by: Paperclip <noreply@paperclip.ing>