Final parts for PERL-883 command monitoring

lib/MongoDB/Role/_CommandMonitoring.pm

@@ -37,12 +37,17 @@ sub publish_command_started {
     return unless $self->monitoring_callback;
 
     $command = _to_tied_ixhash($command);
+    my $command_name = tied(%$command)->Keys(0);
 
     my $event = {
         type         => 'command_started',
         databaseName => $self->db_name,
-        commandName  => tied(%$command)->Keys(0),
-        command      => $command,
+        commandName  => $command_name,
+        command      => (
+            _needs_redaction($command_name)
+                ? _to_tied_ixhash([])
+                : $command,
+        ),
         requestId    => $request_id,
         connectionId => $link->address,
     };
@@ -79,7 +84,11 @@ sub publish_command_reply {
         requestId    => $start_event->{requestId},
         connectionId => $start_event->{connectionId},
         durationSecs => $duration,
-        reply        => $reply,
+        reply        => (
+            _needs_redaction($start_event->{commandName})
+                ? {}
+                : $reply,
+        ),
     };
 
     if ( $reply->{ok} ) {
@@ -158,6 +167,22 @@ sub publish_legacy_query_error {
     return $self->publish_command_reply($reply);
 }
 
+sub _needs_redaction {
+    my ($name) = @_;
+    return 1 if grep { $name eq $_ } qw(
+        authenticate
+        saslStart
+        saslContinue
+        getnonce
+        createUser
+        updateUser
+        copydbgetnonce
+        copydbsaslstart
+        copydb
+    );
+    return 0;
+}
+
 sub _convert_legacy_insert {
     my ( $self, $op_doc ) = @_;
     $op_doc = [$op_doc] unless ref $op_doc eq 'ARRAY';

t/monitoring.t

@@ -253,6 +253,25 @@ subtest "exceptions are command_failed" => sub {
     };
 };
 
+subtest 'redactions' => sub {
+    clear_events();
+    my $mc     = build_client( monitoring_callback => \&event_cb );
+    my $testdb = get_test_db($mc);
+
+    $testdb->run_command([getnonce => 1]);
+    my ($started, $succeeded) =
+        grep { $_->{commandName} eq 'getnonce' }
+        @events;
+
+    is $started->{type}, 'command_started', 'start event';
+    is $succeeded->{type}, 'command_succeeded', 'success event';
+
+    ok defined($started->{command}), 'command not empty';
+    ok defined($succeeded->{reply}), 'reply not empty';
+    is scalar(keys %{ $started->{command} }), 0, 'no command fields';
+    is scalar(keys %{ $succeeded->{reply} }), 0, 'no reply fields';
+};
+
 sub _coll_with_monitor {
     my $mc     = build_client( monitoring_callback => \&event_cb );
     my $testdb = get_test_db($mc);