The type of the object or array being masked.
The object or array to mask.
Optionaloptions: MaskObjectOptionsConfiguration options for masking behavior.
A new object with masked properties (returns original if no masking needed).
// Mask by key list
const user = {
name: 'John',
email: 'john@example.com',
ssn: '123-45-6789'
};
const masked = maskObject(user, { keys: ['ssn', 'email'] });
console.log(masked);
// Output: {
// name: 'John',
// email: 'j***@example.com',
// ssn: '***'
// }
// Mask with predicate function
const userData = {
username: 'john_doe',
password: 'secret123',
apiToken: 'sk_live_xyz'
};
const masked = maskObject(userData, {
isSensitive: (key, value, path) =>
key.toLowerCase().includes('password') ||
key.toLowerCase().includes('token')
});
console.log(masked);
// Output: {
// username: 'john_doe',
// password: '*****',
// apiToken: '******'
// }
// Skip descending into specific objects (e.g., GeoJSON features)
const data = {
apiKey: 'secret123',
geometry: {
type: 'Feature',
coordinates: [10, 20],
properties: { secret: 'should-not-mask' }
}
};
const masked = maskObject(data, {
keys: ['apiKey'],
shouldSkip: (value) => value?.type === 'Feature'
});
console.log(masked);
// Output: apiKey is masked, but geometry object is preserved as-is
// Mask entire GeoJSON geometries without descending
const isGeoJSON = (v: any) =>
v?.type && v?.coordinates &&
['Point', 'LineString', 'Polygon'].includes(v.type);
const geoData = {
name: 'Location',
geometry: {
type: 'Point',
coordinates: [125.6, 10.1]
}
};
const masked = maskObject(geoData, {
isSensitive: (key, value) => key === 'geometry' && isGeoJSON(value)
});
console.log(masked);
// Output: { name: 'Location', geometry: '***' }
// Custom masking function
const data = {
ssn: '123-45-6789',
email: 'john@example.com'
};
const masked = maskObject(data, {
keys: ['ssn', 'email'],
maskFn: (value, key) => {
if (key === 'ssn') return '***-**-' + String(value).slice(-4);
if (key === 'email') return String(value).replace(/(.{1}).*@/, '$1***@');
return '***';
}
});
console.log(masked);
// Output: { ssn: '***-**-6789', email: 'j***@example.com' }
Performance Considerations:
shouldSkip for known large structures that don't need maskingType Preservation:
Depth Control:
Masks sensitive properties in an object or array recursively. Traverses deeply nested structures and masks properties based on keys, predicates, or custom logic.
This function creates a deep copy of the input object/array while masking sensitive values. It handles circular references, special object types (Date, RegExp, Error, etc.), and deeply nested structures. Non-sensitive values are preserved as-is.