feat: add redaction

src/flags.ts

···
   name: string;
   description: string;
   paths: string[]; // The paths this flag blocks
+  redact?: Record<string, string[]>; // path -> fields to strip from JSON
 }
 
 export interface ServiceDefinition {
···
 
   return false;
 }
+
+// Get fields to redact from a JSON response based on host and path
+export function getRedactions(host: string, path: string): string[] {
+  const config = getConfig();
+  const fields: string[] = [];
+
+  for (const [serviceId, service] of Object.entries(config.services)) {
+    if (!host.includes(serviceId) && !serviceId.includes(host)) {
+      continue;
+    }
+
+    for (const [flagId, flag] of Object.entries(service.flags)) {
+      if (!getFlagStatus(flagId)) {
+        continue;
+      }
+
+      if (flag.redact) {
+        for (const [redactPath, redactFields] of Object.entries(flag.redact)) {
+          if (path === redactPath || path.startsWith(redactPath + "?")) {
+            fields.push(...redactFields);
+          }
+        }
+      }
+    }
+  }
+
+  return fields;
+}

src/index.ts

···
   setFlag,
   getFlagDefinition,
   shouldBlock,
+  getRedactions,
 } from "./flags";
 
 import homepage from "../public/index.html";
···
   }
 
   return c.text("OK", 200);
+});
+
+// Proxy JSON endpoint and redact configured fields
+app.get("/proxy/*", async (c) => {
+  const host = c.req.header("X-Orig-Host") || c.req.header("Host") || "";
+  const origPath = c.req.header("X-Orig-Path") || "";
+  const backendUrl = c.req.header("X-Backend-Url");
+  
+  if (!backendUrl) {
+    return c.text("Missing X-Backend-Url header", 400);
+  }
+
+  const res = await fetch(backendUrl);
+  if (!res.ok) {
+    return c.text("Backend error", res.status);
+  }
+
+  const data = await res.json();
+
+  // Redact fields based on config
+  const fieldsToRedact = getRedactions(host, origPath);
+  for (const field of fieldsToRedact) {
+    if (field in data) {
+      if (Array.isArray(data[field])) {
+        data[field] = [];
+      } else if (typeof data[field] === "object" && data[field] !== null) {
+        data[field] = {};
+      } else {
+        delete data[field];
+      }
+    }
+  }
+
+  return c.json(data);
 });
 
 app.get("/auth/login", (c) => {