https://avo.cool logo
Redact sensitive attributes
# avo-3
s
Hey folks, I'd like to hide (blur or redact) sensitive fields on my Avo views by default, unless the user clicks a button to show them. 9 times out of 10 we don't need to see the super sensitive data, so this will help prevent it showing up in screenshots, etc. by mistake. I know I could accomplish this with a
format_using:
helper on each sensitive field, but I worry we'll forget to do that sometime. I was thinking that ideally we'd mark those fields as sensitive somehow on the schema or the model. I think the closest thing is rails models'
filter_attributes
array. I was then thinking I may be able to set some kind of conditional logic based on this by injecting something into
FieldWrapperComponent
, but thought I'd check to see whether this has come up before?
m
Thread automatically created by timwis in #1138182212655788054
l
Hi @sparse-hair-56061 this definitely came up before and the way I thought about it is to make a option on the field, something like
field :sensitive, as: :textarea, redacted: true
In your case does anyone can click and see the content or it would need some authorization layer?
s
Nice! I see you used FieldWrapperComponent for that as well. I'll see if I can modify that using the injection approach your docs recommend for Application controller.
Would be ideal if it detected the redacted state from the model's filterrd_attributes property but maybe that's not universal
l
yup. definitely a great idea
I'll add it to the roadmap
TIL about
filtered_attributes
. I knew about encrypted attributes before
this should pair nicely with the audit logging feature to add an entry when someone clicked to view one of these attributes
s
Exactly!
Yeah Phoenix/Ecto have an even nicer way to do it by marking
redact: true
when defining the schema https://hexdocs.pm/ecto/Ecto.Schema.html#module-example