saving masking helper.

Author: EMaher

tests/integration/all-resource-types/MaskingHelpers.psm1

@@ -3,12 +3,69 @@
 #
 #   Import-Module (Join-Path $PSScriptRoot 'MaskingHelpers.psm1') -Force
 #
-# All exported functions use approved PowerShell verbs.
 
 # Module-scoped flag. Flip to $false locally if you need to see raw values
 # while debugging — never commit that change.
 $script:EnableMasking = $true
 
+# Built-in regex redactions applied by Protect-LogLine on every line, in
+# addition to caller-supplied exact-match Replacements. These cover sensitive
+# values that the caller cannot enumerate up front (ARM async-operation
+# signing material, request IDs, etc.).
+#
+# IMPORTANT: keep these patterns conservative. We deliberately do NOT mask
+# every GUID, because well-known role-definition IDs and template hashes are
+# legitimately public and useful in debugging. Anchor patterns to the path
+# segment, header name, or query-parameter context that makes the value
+# sensitive.
+#
+# References:
+# - ARM async operations contract (see `Azure-AsyncOperation` /
+#   `operationStatuses` URL shape with t/c/s/h query parameters):
+#   https://learn.microsoft.com/azure/azure-resource-manager/management/async-operations
+# - Azure correlation / request IDs (`x-ms-correlation-request-id`,
+#   `x-ms-request-id`, `x-ms-client-request-id`):
+#   https://learn.microsoft.com/azure/azure-resource-manager/management/request-limits-and-throttling
+$script:BuiltinRedactions = @(
+    # ARM async-operation signing material: t= (timestamp), c= (cert),
+    # s= (signature), h= (hash) on operationStatuses / operationResults URLs.
+    # These query parameters are effectively a bearer credential for polling
+    # the long-running operation result and MUST NOT appear in logs.
+    @{ Pattern = '([?&])(t|c|s|h)=[^&''"\s]+'
+       Replacement = '$1$2=<REDACTED:arm-async>' }
+
+    # Azure subscription IDs embedded in ARM resource paths.
+    @{ Pattern = '/subscriptions/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}'
+       Replacement = '/subscriptions/<SUBSCRIPTION_ID>' }
+
+    # ARM long-running operation IDs (numeric or alphanumeric, 10+ chars)
+    # following /operationStatuses/ or /operationResults/.
+    @{ Pattern = '/(operationStatuses|operationResults)/[A-Za-z0-9._-]{10,}'
+       Replacement = '/$1/<OPERATION_ID>' }
+
+    # x-ms-correlation-request-id, x-ms-request-id, x-ms-client-request-id
+    # header values. Match Python-repr style (`'x-ms-request-id': 'guid'`),
+    # HTTP-header style (`x-ms-request-id: guid`), and JSON style.
+    @{ Pattern = "(?i)(['""]?x-ms-(?:correlation-)?(?:request|client-request)-id['""]?\s*[:=]\s*['""]?)[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
+       Replacement = '$1<REDACTED:request-id>' }
+
+    # x-ms-routing-request-id: '<REGION>:<TIMESTAMP>:<guid>'. Mask the whole
+    # value because all three components (region, timestamp, GUID) leak
+    # tenant geography / activity timing.
+    @{ Pattern = "(?i)(['""]?x-ms-routing-request-id['""]?\s*[:=]\s*['""]?)[A-Z0-9]+:\d{8}T\d{6}Z:[0-9a-fA-F-]{36}"
+       Replacement = '$1<REDACTED:routing-request-id>' }
+
+    # Authorization: Bearer <token>  — defense in depth. We do not expect
+    # bearer tokens to appear because `az --debug` redacts them by default,
+    # but if Azure CLI ever changes that, this catches them.
+    @{ Pattern = "(?i)(authorization[:\s=]+bearer\s+)[A-Za-z0-9._\-+/=]+"
+       Replacement = '$1<REDACTED:bearer>' }
+
+    # JWT-shaped tokens (eyJ<base64url>.<base64url>.<base64url>).
+    @{ Pattern = '\beyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}'
+       Replacement = '<REDACTED:jwt>' }
+)
+
 function Protect-Identifier {
     param(
         [string]$Value,
@@ -50,17 +107,31 @@ function Protect-LogLine {
         [hashtable]$Replacements
     )
 
-    if (-not $script:EnableMasking -or [string]::IsNullOrEmpty($Line) -or -not $Replacements) {
+    if (-not $script:EnableMasking -or [string]::IsNullOrEmpty($Line)) {
         return $Line
     }
 
     $protectedLine = $Line
-    foreach ($entry in $Replacements.GetEnumerator()) {
-        if ([string]::IsNullOrEmpty($entry.Key) -or [string]::IsNullOrEmpty($entry.Value)) {
-            continue
+
+    # Pass 1: caller-supplied exact-string replacements (sub id, RG name, ...).
+    if ($Replacements) {
+        foreach ($entry in $Replacements.GetEnumerator()) {
+            if ([string]::IsNullOrEmpty($entry.Key) -or [string]::IsNullOrEmpty($entry.Value)) {
+                continue
+            }
+
+            $protectedLine = $protectedLine.Replace($entry.Key, $entry.Value)
         }
+    }
 
-        $protectedLine = $protectedLine.Replace($entry.Key, $entry.Value)
+    # Pass 2: built-in regex redactions for well-known secret shapes that
+    # callers cannot enumerate up front (ARM signing material, request IDs,
+    # operation IDs, bearer tokens). Always applied.
+    foreach ($rule in $script:BuiltinRedactions) {
+        $protectedLine = [System.Text.RegularExpressions.Regex]::Replace(
+            $protectedLine,
+            $rule.Pattern,
+            $rule.Replacement)
     }
 
     return $protectedLine