package metrics

import "regexp"

// Redaction is controller-side and authoritative: every context line and log-tail line
// must pass through RedactLine before it leaves the box (rides the hub report).
var (
	// key[=: ]value shapes — the value is masked. The optional "bearer " prefix inside the
	// value group catches "Authorization: Bearer <token>" in one pass.
	reSecretKV = regexp.MustCompile(`(?i)\b(password|passwd|secret|token|api[_-]?key|authorization|bearer)([=: ]\s*)((?:bearer\s+)?\S+)`)
	// 64-hex string = restic repo password / key-material shape.
	reHex64 = regexp.MustCompile(`\b[0-9a-fA-F]{64}\b`)
)

// RedactLine masks secret-shaped values in a log line. Applied to context lines and
// log-tail lines before shipping; deliberately narrow (support usefulness over
// aggression) but the named patterns are non-negotiable.
func RedactLine(s string) string {
	s = reSecretKV.ReplaceAllString(s, "${1}${2}[REDACTED]")
	s = reHex64.ReplaceAllString(s, "[REDACTED-HEX64]")
	return s
}