<?php

declare(strict_types=1);

namespace WordPress\CloudflareWorkersAiProvider\Diagnostics;

use function WordPress\CloudflareWorkersAiProvider\get_account_id;
use function WordPress\CloudflareWorkersAiProvider\get_api_key;
use function WordPress\CloudflareWorkersAiProvider\get_plugin_settings;

if (!defined('ABSPATH')) {
    exit;
}

/**
 * Takes out of a text what must not leave the site in a diagnostics report or an error log:
 * the account ID, tokens and keys, passwords, the site's own address and the Qdrant and
 * PostgreSQL hosts, email addresses and IP addresses.
 */
final class Redact
{
    public static function text(string $text): string
    {
        $s       = get_plugin_settings();
        $secrets = array_filter([
            get_api_key(),
            (string) ($s['api_key'] ?? ''),
            (string) ($s['gateway_token'] ?? ''),
            (string) ($s['qdrant_api_key'] ?? ''),
            (string) ($s['pg_password'] ?? ''),
        ], static fn(string $v): bool => strlen($v) >= 6);
        foreach ($secrets as $secret) {
            $text = str_replace($secret, '{secret}', $text);
        }
        $account = get_account_id();
        if ($account !== '') {
            $text = str_replace($account, '{account}', $text);
        }
        $hosts = array_filter([
            (string) wp_parse_url(home_url(), PHP_URL_HOST),
            (string) wp_parse_url((string) ($s['qdrant_url'] ?? ''), PHP_URL_HOST),
            (string) ($s['pg_host'] ?? ''),
        ]);
        foreach ($hosts as $host) {
            $text = str_ireplace($host, '{host}', $text);
        }
        $text = (string) preg_replace('/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i', '{email}', $text);
        $text = (string) preg_replace('/\b(?:\d{1,3}\.){3}\d{1,3}\b/', '{ip}', $text);
        $text = (string) preg_replace('/\b[0-9a-f]{32}\b/i', '{id}', $text);
        return (string) preg_replace('/\bBearer\s+\S+/i', 'Bearer {secret}', $text);
    }
}