package redaction

import (
	"regexp"
	"strings"
)

const replacement = "<redacted>"

var sensitivePattern = regexp.MustCompile(`(?i)(authorization|cookie|password|passwd|secret|token|api[_-]?key|client[_-]?secret)(\s*[:=]\s*)(?:bearer\s+)?([^,;\s]+)`)

func String(value string) string {
	return sensitivePattern.ReplaceAllString(value, `$1$2`+replacement)
}

func Value(key string, value any) any {
	if sensitiveKey(key) {
		return replacement
	}
	return value
}

func Map(values map[string]any) map[string]any {
	clean := make(map[string]any, len(values))
	for key, value := range values {
		clean[key] = Value(key, value)
	}
	return clean
}

func sensitiveKey(key string) bool {
	key = strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(key, "-", "_"), " ", "_"))
	for _, part := range []string{"authorization", "cookie", "password", "passwd", "secret", "token", "api_key", "apikey", "client_secret"} {
		if strings.Contains(key, part) {
			return true
		}
	}
	return false
}