Struct Masking 

pub struct Masking {
    pub max_bytes: u64,
    pub fields: Vec<String>,
    pub groups: BTreeMap<String, Vec<String>>,
}

Response field masking policy (DW-029, feature analysis 5-Security “response field masking”): RFC 6901 pointers whose values are replaced with the fixed MASKED_VALUE sentinel on the route’s responses, before any other body-handling stage. The mass-assignment/data-leak guard: a field named here NEVER reaches the client, whatever the upstream put in it.

Semantics (frozen; enforcement lives in dataplane::transforms):

• PRECEDENCE is the deny-anywhere-wins analog for a redaction policy: the effective pointer set is the UNION of fields (the floor, every consumer on the route) and every groups entry the authenticated consumer belongs to. A group entry can only ADD pointers — there is deliberately no mechanism by which a group is EXEMPTED from the route floor (that would be a allow-anywhere escape hatch on a security policy).
• The redacted value is the FIXED string MASKED_VALUE, not configurable: one sentinel everywhere, so clients and audit tooling can rely on the exact shape.
• Masking is explicitly buffering under max_bytes and FAILS CLOSED: a response that is content-encoded, not JSON, over the cap, unparseable, or misses a configured pointer answers 502 — never a passthrough of bytes the gateway could not prove clean (see the module docs; the inverse of the DW-028 transform gates).

Fields

max_bytes: u64

Maximum response body size (bytes) this route will buffer to mask. Must be >= 1 (validation); no upper bound, the same operator-owns-the-memory-budget stance as the DW-028 transform cap.

fields: Vec<String>

Pointers masked for EVERY consumer on this route (the floor). Each must parse as an RFC 6901 pointer and not be the root (validation); each must RESOLVE on every JSON response the route serves, or the response fails closed (schema drift, the same strictness as the DW-028 body transform).

groups: BTreeMap<String, Vec<String>>

Extra pointers masked per consumer GROUP: group name -> pointers (unioned with fields for members of the group; consumers in no listed group get the floor alone). Validation checks the group names resolve against some config consumer’s groups (the same store-only-group caveat as authorization group rules).

Trait Implementations

impl Clone for Masking

fn clone(&self) -> Masking

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Masking

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Masking

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Masking

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for Masking

fn eq(&self, other: &Masking) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Masking

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Masking