"""Secret redaction for anything shown on screen or written to disk.

Firmware prints the OTA token in clear text (ota_client.cpp:
"OTA token loaded from NVS: %s", "received token: %s") and env.txt
values may be echoed. Influx tokens are ~88-char base64 strings.
Redaction is applied before a line leaves the serial layer.
"""

from __future__ import annotations

import re

MASK = "<REDACTED>"

_RULES: list[re.Pattern[str]] = [
    # "... token loaded from NVS: X", "... received token: X", "token: X"
    re.compile(r"(?i)(\btoken\b[^:=\n]{0,40}[:=]\s*)(\S+)"),
    # HTTP auth header echo: "Authorization: Token X" / "Token X"
    re.compile(r"(\bToken\s+)([A-Za-z0-9_\-+/=]{16,})"),
    # env-style secrets: INFLUX_TOKEN=..., PASSWORD=...
    re.compile(r"(?i)(\b(?:INFLUX_TOKEN|PASSWORD|PASS|SECRET|API_KEY)\s*=\s*)(\S+)"),
]
# Bare long base64/url-safe blobs (Influx tokens end in "==").
_BLOB = re.compile(r"(?<![A-Za-z0-9_\-+/])[A-Za-z0-9_\-+/]{40,}={0,2}(?![A-Za-z0-9_\-+/=])")
# Pure hex runs (MACs, addresses, hashes) are not secrets.
_BLOB_ALLOW = re.compile(r"^[0-9A-Fa-f]+$")


def redact(text: str) -> str:
    for rule in _RULES:
        text = rule.sub(lambda m: m.group(1) + MASK, text)

    def _blob(m: re.Match[str]) -> str:
        s = m.group(0)
        return s if _BLOB_ALLOW.search(s) else MASK

    return _BLOB.sub(_blob, text)