Function maskFieldBySourcePaths

backend/api/v1/document_masking.go:299–308

maskFieldBySourcePaths checks all source paths for sensitivity, then falls back to recursive walk.

(value any, paths []*parserbase.PathAST, objectSchema *storepb.ObjectSchema, semanticTypeToMasker map[string]masker.Masker)

// maskFieldBySourcePaths checks all source paths for sensitivity, then falls back to recursive walk.
func maskFieldBySourcePaths(value any, paths []*parserbase.PathAST, objectSchema *storepb.ObjectSchema, semanticTypeToMasker map[string]masker.Masker) (any, error) {
	if maskedValue, masked, err := maskBySourcePaths(value, paths, objectSchema, semanticTypeToMasker); err != nil {
		return nil, err
	} else if masked {
		return maskedValue, nil
	}
	ast := stripContainerFromPath(paths[0])
	o, _ := getObjectSchemaByPath(objectSchema, ast)
	return walkAndMaskJSONRecursive(value, o, semanticTypeToMasker)
}

// maskFieldByDirectLookup looks up the key directly in the schema (used when no field paths are recorded).
func maskFieldByDirectLookup(key string, value any, objectSchema *storepb.ObjectSchema, semanticTypeToMasker map[string]masker.Masker) (any, error) {