package main

// Port of lib/redact.js. The three patterns and replacements are copied
// verbatim from the JS regexes (all case-insensitive) and applied in the
// same order.

import "regexp"

var (
	rePrivateKey  = regexp.MustCompile(`(?i)\bPrivate\s*Key\s*:\s*[^\s,;]+`)
	reAgentKey    = regexp.MustCompile(`(?i)\bNG_AGENT_KEY\s*=\s*[^\s,;]+`)
	reBearerToken = regexp.MustCompile(`(?i)\bBearer\s+[^\s,;]+`)
)

// RedactSecrets strips Reality private keys, agent keys and bearer tokens
// from a string before it is retained in job history or API responses.
func RedactSecrets(s string) string {
	s = rePrivateKey.ReplaceAllString(s, "PrivateKey: [REDACTED]")
	s = reAgentKey.ReplaceAllString(s, "NG_AGENT_KEY=[REDACTED]")
	s = reBearerToken.ReplaceAllString(s, "Bearer [REDACTED]")
	return s
}