export const REDACTED = "[REDACTED]";

// scheme://user:password@host — only redacts when a password is present, so
// ordinary URLs (with or without a userinfo) are left untouched.
const URL_CREDENTIALS = /\b([a-z][a-z0-9+.-]*:\/\/)[^/\s@]+:[^/\s@]*@/gi;

// AWS access key ID (AKIA prefix + 16 uppercase alphanumeric chars).
const AWS_ACCESS_KEY_ID = /\bAKIA[0-9A-Z]{16}\b/g;

// OpenSSH and other PEM private key headers embedded anywhere in a string.
const PRIVATE_KEY_HEADER = /-----BEGIN [A-Z ]*PRIVATE KEY-----/g;

// Secret-bearing environment assignments are commonly included in provider
// and command error messages (for example, DB_PASSWORD=...).
const SECRET_ASSIGNMENT =
  /\b([A-Z][A-Z0-9_]*(?:PASSWORD|PASSWD|TOKEN|SECRET|CREDENTIAL|PRIVATE_KEY|ACCESS_KEY|CONNECTION_STRING|DATABASE_URL)[A-Z0-9_]*)\s*[=:]\s*([^\s,;\]}]+)/gi;
const SECRET_FIELD =
  /(["']?(?:password|passwd|token|secret|credential|privateKey|accessKey|connectionString|databaseUrl)["']?\s*:\s*["']?)([^"'\s,}\]]+)/gi;
const SECRET_DATA =
  /((?:["'](?:kind|type)["']\s*:\s*["'](?:Secret|secret)["'][\s\S]{0,1000}?["'](?:data|stringData)["']\s*:\s*)\{[^{}]*\})/gi;

/** Redact common credential-bearing substrings while leaving everything else intact. */
export function redactString(value: string): string {
  return value
    .replace(AWS_ACCESS_KEY_ID, REDACTED)
    .replace(PRIVATE_KEY_HEADER, REDACTED)
    .replace(SECRET_ASSIGNMENT, (_match, key) => `${key}=${REDACTED}`)
    .replace(SECRET_FIELD, (_match, prefix) => `${prefix}${REDACTED}`)
    .replace(SECRET_DATA, (_match, prefix) =>
      prefix.replace(/\{[^{}]*\}$/, `{${REDACTED}}`),
    )
    .replace(URL_CREDENTIALS, (_match, scheme) => `${scheme}${REDACTED}@`);
}