Function rewrite_path_segment

crates/openshell-core/src/secrets.rs:814–865

(
    segment: &str,
    resolver: &SecretResolver,
)

// `rewrite_request_line`.
#[allow(clippy::similar_names)]
fn rewrite_path_segment(
    segment: &str,
    resolver: &SecretResolver,
) -> Result<(String, String), UnresolvedPlaceholderError> {
    let mut resolved = String::with_capacity(segment.len());
    let mut redacted = String::with_capacity(segment.len());
    let mut pos = 0;
    let bytes = segment.as_bytes();

    while pos < bytes.len() {
        let next_canonical = segment[pos..].find(PLACEHOLDER_PREFIX).map(|p| pos + p);
        let next_alias = segment[pos..]
            .find(PROVIDER_ALIAS_MARKER)
            .map(|marker_pos| {
                let marker_abs = pos + marker_pos;
                alias_start_for_marker(segment, marker_abs)
            });
        if let Some(abs_start) = [next_canonical, next_alias].into_iter().flatten().min() {
            // Copy literal prefix before the placeholder
            resolved.push_str(&segment[pos..abs_start]);
            redacted.push_str(&segment[pos..abs_start]);

            let Some((token_end, full_placeholder)) = canonical_token_at(segment, abs_start)
                .or_else(|| alias_token_at(segment, abs_start))
            else {
                return Err(UnresolvedPlaceholderError { location: "path" });
            };
            if let Some(secret) = resolver.resolve_placeholder(full_placeholder) {
                validate_credential_for_path(secret).map_err(|reason| {
                    tracing::warn!(
                        location = "path",
                        %reason,
                        "credential resolution rejected: resolved value unsafe for path"
                    );
                    UnresolvedPlaceholderError { location: "path" }
                })?;
                resolved.push_str(secret);
                redacted.push_str("[CREDENTIAL]");
            } else {
                return Err(UnresolvedPlaceholderError { location: "path" });
            }
            pos = token_end;
        } else {
            // No more placeholders in remainder
            resolved.push_str(&segment[pos..]);
            redacted.push_str(&segment[pos..]);
            break;
        }
    }

    Ok((resolved, redacted))
}

/// Rewrite placeholders in query parameter values.
///