/**
 * Conservative log-line redaction for API/SSE responses.
 *
 * Preserves raw log files on disk; only use this when serializing lines to
 * HTTP/SSE clients. The regexes are intentionally anchored to known secret
 * markers so ordinary error messages, file paths, ports, and throughput metrics
 * are not eaten.
 */

const REDACTED = "[redacted]";

/**
 * Token-like value that stops at common separators/punctuation so surrounding
 * log context (semicolons, commas, quotes) is preserved.
 */
const TOKEN = String.raw`[^\s;,"']+`;

/**
 * Redact common secret-bearing patterns from a single log line.
 *
 * Covered:
 * - Authorization: Bearer <token>
 * - X-Api-Key: <token>
 * - Env assignments: HF_TOKEN=..., OPENAI_API_KEY=..., *_API_KEY=..., *_TOKEN=...
 * - JSON-ish pairs: "api_key": "...", 'token': '...'
 * - CLI flags: --api-key <value>, --hf-token <value>, --token <value>, etc.
 * - URL query params: ?api_key=...&token=...
 */
export function redactLogLine(line: string): string {
  let redacted = line;

  // Authorization / Bearer headers.
  redacted = redacted.replace(
    new RegExp(String.raw`(Authorization:\s*Bearer\s+)` + TOKEN, "gi"),
    `$1${REDACTED}`,
  );

  // X-Api-Key style headers.
  redacted = redacted.replace(
    new RegExp(String.raw`((?:^|[\r\n])[Xx]-[Aa]pi-[Kk]ey:\s+)` + TOKEN, "g"),
    `$1${REDACTED}`,
  );

  // Env-style assignments: KEY=VALUE or export KEY=VALUE.
  // Covers explicit keys plus generic *_API_KEY / *_TOKEN patterns.
  redacted = redacted.replace(
    new RegExp(
      String.raw`((?:^|[\s;{"'|&]|export\s+)(?:HF_TOKEN|HUGGING_FACE_HUB_TOKEN|OPENAI_API_KEY|ANTHROPIC_API_KEY|[A-Za-z_][A-Za-z0-9_]*_API_KEY|[A-Za-z_][A-Za-z0-9_]*_TOKEN)\s*=\s*)(?:"[^"]*"|'[^']*'|` +
        TOKEN +
        ")",
      "g",
    ),
    `$1${REDACTED}`,
  );

  // JSON-ish key/value pairs: "api_key": "...", 'token': '...'.
  // Preserves the quote style of the value.
  redacted = redacted.replace(
    /(["']?(?:api_key|api-key|apikey|auth_token|access_token|token|secret|password|hf_token|openai_api_key|anthropic_api_key)["']?\s*:\s*)(["'])[^"']*\2/gi,
    `$1$2${REDACTED}$2`,
  );

  // CLI long flags: --api-key <value>, --hf-token <value>, etc.
  redacted = redacted.replace(
    new RegExp(
      String.raw`(\s)(--(?:api-key|apikey|api_token|auth-token|access-token|hf-token|token|secret|password))\s+` +
        TOKEN,
      "gi",
    ),
    `$1$2 ${REDACTED}`,
  );

  // URL query parameters: api_key=..., token=..., etc.
  redacted = redacted.replace(
    /([?&])(api_key|api-key|apikey|token|access_token|auth_token|key|secret|hf_token|openai_api_key|anthropic_api_key)=([^&\s]*)/gi,
    `$1$2=${REDACTED}`,
  );

  return redacted;
}