Transformation Rules

pip install declaw python-dotenv

from declaw import Sandbox, SecurityPolicy, TransformationRule, TransformDirection

rules = [
    # Mask internal hostnames before requests leave the sandbox
    TransformationRule(
        match=r"internal\.company\.com",
        replace="api.example.com",
        direction="outbound",
    ),
    # Strip bearer tokens from inbound API responses
    TransformationRule(
        match=r"Bearer sk-[a-zA-Z0-9]+",
        replace="Bearer [MASKED]",
        direction="inbound",
    ),
    # Filter passwords in both directions
    TransformationRule(
        match=r"password=\w+",
        replace="password=[FILTERED]",
        direction="both",
    ),
]

sbx = Sandbox.create(
    template="base",
    timeout=300,
    security=SecurityPolicy(
        transformations=rules,
    ),
)

# TransformationRule.apply() runs the regex substitution locally
rule = TransformationRule(
    match=r"internal\.company\.com",
    replace="api.example.com",
    direction="outbound",
)

before = "Calling https://internal.company.com/api/v2/users to fetch data"
after = rule.apply(before)
# after -> "Calling https://api.example.com/api/v2/users to fetch data"
print(f"Before: {before}")
print(f"After:  {after}")

# TransformationRule.applies_to() checks direction filtering
print(rule.applies_to("outbound"))  # True
print(rule.applies_to("inbound"))   # False

sbx.kill()

============================================================
Declaw Transformation Rules Example
============================================================

--- Creating Sandbox with Transformation Rules ---
Sandbox created: sbx_abc123

Security policy applied:
  transformations: 3 rule(s)
    1. match='internal\\.company\\.com'  replace='api.example.com'  direction=outbound
    2. match='Bearer sk-[a-zA-Z0-9]+'  replace='Bearer [MASKED]'  direction=inbound
    3. match='password=\\w+'  replace='password=[FILTERED]'  direction=both

------------------------------------------------------------
Local Regex Matching Demo (TransformationRule.apply)
------------------------------------------------------------

  Rule:      match='internal\\.company\\.com'  replace='api.example.com'
  Direction: outbound
  Before:    Calling https://internal.company.com/api/v2/users to fetch data
  After:     Calling https://api.example.com/api/v2/users to fetch data

  Rule:      match='Bearer sk-[a-zA-Z0-9]+'  replace='Bearer [MASKED]'
  Direction: inbound
  Before:    Authorization: Bearer sk-abc123XYZ789secretToken
  After:     Authorization: Bearer [MASKED]

  Rule:      match='password=\\w+'  replace='password=[FILTERED]'
  Direction: both
  Before:    POST /login?password=hunter2&user=admin HTTP/1.1
  After:     POST /login?password=[FILTERED]&user=admin HTTP/1.1

--- Cleaning Up ---
Sandbox killed.

============================================================
Done!
============================================================