<?php
/**
 * Small diagnostic redaction helpers.
 *
 * @package ActionPanelAI
 */

namespace ActionPanelAI\Support;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Redacts obvious secrets from bounded troubleshooting text.
 */
class Redactor {
	private const PATTERNS = array(
		'/-----BEGIN\s+(?:[A-Z\s]+)-----[\s\S]+?-----END\s+[A-Z\s]+-----/i' => '[redacted-key]',
		'/(define\(\s*[\'"](?:DB_PASSWORD|AUTH_KEY|SECURE_AUTH_KEY|LOGGED_IN_KEY|NONCE_KEY|AUTH_SALT|SECURE_AUTH_SALT|LOGGED_IN_SALT|NONCE_SALT|ACTIONPANEL_AI_API_KEY|OPENAI_API_KEY)[\'"]\s*,\s*).+?(\s*\);)/is' => '$1\'[redacted]\'$2',
		'/((?:password|pass|pwd|secret|token|api[_-]?key|access[_-]?token)\s*[:=]\s*)(["\']?)([^\s"\']{4,})(["\']?)/i' => '$1[redacted]',
		'/(Authorization\s*:\s*Bearer\s+)([A-Za-z0-9\-_.~]{8,})/i' => '$1[redacted]',
		'/(?:api[_-]?key|access[_-]?token|secret|bearer|oauth|auth|password|pwd|pass|key)=[A-Za-z0-9._\-]{12,}/i' => '[redacted-key]',
		'/\b(?:sk|rk|pk|tok)_[A-Za-z0-9]{16,}\b/' => '[redacted-key]',
		'/\bxox[abpst]-[A-Za-z0-9-]{10,}\b/'      => '[redacted-key]',
		'/\bAIza[0-9A-Za-z_\-]{35}\b/'            => '[redacted-key]',
		'/\b(?:\d[ -]*?){13,19}\b/'               => '[redacted-cc]',
	);

	/**
	 * Redact sensitive tokens from a plain string.
	 */
	public static function redact( string $text ): string {
		$redacted = $text;
		foreach ( self::PATTERNS as $pattern => $replacement ) {
			$redacted = (string) preg_replace( $pattern, $replacement, $redacted );
		}
		return $redacted;
	}

	/**
	 * Redact strings recursively across arrays.
	 *
	 * @param mixed $data Input value.
	 * @return mixed
	 */
	public static function redact_recursive( $data ) {
		if ( is_string( $data ) ) {
			return self::redact( $data );
		}
		if ( is_array( $data ) ) {
			foreach ( $data as $key => $value ) {
				$data[ $key ] = self::redact_recursive( $value );
			}
		}
		return $data;
	}
}