<?php
/**
 * Shared redaction for text that leaves the server (v1.5.2, review F1).
 *
 * One implementation for every string an agent or the audit log can see
 * that was not written by this plugin: PHP exception messages, core
 * upgrader/filesystem messages (which name absolute paths), Site Health test
 * failures, and the debug-log tail. Originally read-debug-log's private
 * redact_line() (v1.3 §4 taxonomy, validated against the planning corpus);
 * extracted because the audit log is readable through
 * agent-toolbelt/read-audit-log — a message that "never leaves the server"
 * must not be one hop away from the same agent.
 *
 * Best-effort defence-in-depth, not a guarantee (the debug-log output says
 * so to the agent). Order matters: specific provider patterns run before the
 * generic catch-alls so a Stripe key is tagged [stripe-secret-key], not
 * [redacted].
 */

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

if ( ! class_exists( 'ATB_Redactor' ) ) {
    class ATB_Redactor
    {
        /**
         * Masks secrets, absolute paths, emails, and IP addresses in one
         * string (one log line, one error message).
         *
         * @param string $atb_line
         * @return string
         */
        public static function text( $atb_line )
        {
            $atb_line = (string) $atb_line;

            // A. Filesystem paths: WP root and wp-content become relative, the
            // home directory collapses to ~ (covers logs from CLI contexts).
            $atb_abspath = rtrim( ABSPATH, '/\\' );
            $atb_line    = str_replace( array( $atb_abspath . '/', $atb_abspath ), '', $atb_line );
            if ( defined( 'WP_CONTENT_DIR' ) ) {
                $atb_content = rtrim( WP_CONTENT_DIR, '/\\' );
                $atb_line    = str_replace( $atb_content, 'wp-content', $atb_line );
            }
            $atb_home = (string) getenv( 'HOME' );
            if ( '' !== $atb_home && '/' !== $atb_home ) {
                $atb_line = str_replace( rtrim( $atb_home, '/\\' ), '~', $atb_line );
            }

            // B. Named provider secrets (high specificity first).
            $atb_patterns = array(
                '/\bsk_live_[A-Za-z0-9]{10,}/'   => '[stripe-secret-key]',
                '/\bsk_test_[A-Za-z0-9]{10,}/'   => '[stripe-test-key]',
                '/\b[rp]k_live_[A-Za-z0-9]{10,}/' => '[stripe-key]',
                '/\bwhsec_[A-Za-z0-9]{6,}/'      => '[webhook-secret]',
                '/\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}/' => '[ai-api-key]',
                '/\bAKIA[0-9A-Z]{16}\b/'         => '[aws-access-key-id]',
                '/\bgh[pousr]_[A-Za-z0-9]{20,}\b/' => '[github-token]',
                '/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/' => '[jwt]',
                '/\bBearer\s+[A-Za-z0-9._\-]{8,}/i' => 'Bearer [token]',
            );
            foreach ( $atb_patterns as $atb_re => $atb_repl ) {
                $atb_line = (string) preg_replace( $atb_re, $atb_repl, $atb_line );
            }

            // C. DB "Access denied for user 'x'@'host'".
            $atb_line = (string) preg_replace( "/for user '[^']*'@'[^']*'/", "for user '[db-user]'@'[host]'", $atb_line );

            // D. URL query-string secrets.
            $atb_line = (string) preg_replace_callback(
                '/([?&](?:api_?key|apikey|secret|token|password|passwd|pwd|auth|access_token|key|sig|signature)=)[^&\s"\']+/i',
                static function ( $atb_m ) {
                    return $atb_m[1] . '[redacted]';
                },
                $atb_line
            );

            // E. Generic assignments and quoted passwords. The value pattern
            // stops before quotes and closing brackets so surrounding syntax
            // survives (the planning-corpus lesson).
            $atb_line = (string) preg_replace( '/\bsecret\s+[A-Za-z0-9\/+]{16,}/i', 'secret [redacted]', $atb_line );
            $atb_line = (string) preg_replace(
                '/\b(api[_-]?key|apikey|secret|token|password|passwd|pwd|auth)\b(["\']?\s*[:=]\s*["\']?)(?!\[)[^\s"\',;)\]}]+/i',
                '$1$2[redacted]',
                $atb_line
            );
            $atb_line = (string) preg_replace( '/\b(pass(?:word)?)\s+"[^"]*"/i', '$1 "[redacted]"', $atb_line );

            // F. Auth cookies and nonces.
            $atb_line = (string) preg_replace( '/\bwordpress[a-z_]*_[a-f0-9]{6,}=[^\s;]+/i', 'wordpress_cookie=[redacted]', $atb_line );
            $atb_line = (string) preg_replace( '/\b_wpnonce=[A-Za-z0-9]+/', '_wpnonce=[redacted]', $atb_line );

            // G. Emails: keep the domain, mask the local part.
            $atb_line = (string) preg_replace_callback(
                '/\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/',
                static function ( $atb_m ) {
                    $atb_at = strpos( $atb_m[0], '@' );
                    return substr( $atb_m[0], 0, 1 ) . '***@' . substr( $atb_m[0], $atb_at + 1 );
                },
                $atb_line
            );

            // H. IPv4: keep the /16 for debugging locality, mask the host part.
            $atb_line = (string) preg_replace( '/\b(\d{1,3})\.(\d{1,3})\.\d{1,3}\.\d{1,3}\b/', '$1.$2.x.x', $atb_line );

            // I. IPv6 (v1.5.2): full form needs at least five hextet groups so
            // clock times (09:40:20) never match; compressed forms need a "::".
            // MAC-like 6-group sequences are masked too — also identifiers.
            $atb_line = (string) preg_replace( '/(?<![\w:.])(?:[0-9a-f]{1,4}:){4,7}[0-9a-f]{1,4}(?![\w:.])/i', '[ipv6]', $atb_line );
            $atb_line = (string) preg_replace( '/(?<![\w:.])(?:[0-9a-f]{1,4}:){1,6}:(?:[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){0,5})?(?![\w:.])/i', '[ipv6]', $atb_line );
            $atb_line = (string) preg_replace( '/(?<![\w:.])::(?:[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){0,6})(?![\w:.])/i', '[ipv6]', $atb_line );

            return $atb_line;
        }

        /**
         * Stricter variant for foreign MESSAGES (exceptions, core upgrader
         * output, a plugin's Site Health test): everything text() does, plus
         * any remaining absolute Unix path (two or more segments) becomes
         * [path]. The debug-log tail keeps paths outside the site readable
         * for diagnosis; a one-line error message does not need them.
         *
         * @param string $atb_text
         * @return string
         */
        public static function message( $atb_text )
        {
            $atb_text = self::text( $atb_text );
            return (string) preg_replace( '/(?<![\w\/:~.])\/(?:[A-Za-z0-9._-]+\/){2,}[A-Za-z0-9._-]*/', '[path]', $atb_text );
        }
    }
}