"""Redaction for job errors and log lines: no password, key or token ever reaches job_runs or a log."""

from __future__ import annotations

import os
import re

MAX_ERRORS = 20
MAX_ERROR_CHARS = 500

# Environment variables whose values are secrets when set (MFilesKit reads MFILES_PASSWORD; VisualKit may read
# VISUAL_PASSWORD). They are read only to strip them from text, never logged.
SECRET_ENV = ("VISUAL_PASSWORD", "MFILES_PASSWORD", "PGPASSWORD", "LDAP_PASSWORD")
SECRET_FILE_ENV = ("VISUAL_PASSWORD_FILE", "MFILES_PASSWORD_FILE")

_PATTERNS = (
    re.compile(r"(?i)\b(password|passwd|pwd|secret|token|api[_-]?key)\s*[=:]\s*(\"[^\"]*\"|'[^']*'|[^\s;,&]+)"),
    re.compile(r"(?i)\bauthorization\s*:\s*[^\r\n]*"),
    re.compile(r"(?i)\bx-authentication\s*:\s*[^\r\n]*"),
    re.compile(r"(?i)(\w+://[^:/\s@]+:)([^@\s]+)(@)"),
)


def _secrets() -> list[str]:
    out = []
    for name in SECRET_ENV:
        v = os.environ.get(name)
        if v and len(v) >= 4:
            out.append(v)
    for name in SECRET_FILE_ENV:
        path = os.environ.get(name)
        if not path:
            continue
        try:
            with open(path, encoding="utf-8") as f:
                v = f.read().rstrip("\r\n")
        except OSError:
            continue
        if v and len(v) >= 4:
            out.append(v)
    return out


def redact(text: str) -> str:
    """Strip anything that looks like a credential, plus the VISUAL and M-Files passwords if set."""
    s = str(text)
    for secret in _secrets():
        s = s.replace(secret, "[redacted]")
    s = _PATTERNS[0].sub(lambda m: f"{m.group(1)}=[redacted]", s)
    s = _PATTERNS[1].sub("Authorization: [redacted]", s)
    s = _PATTERNS[2].sub("X-Authentication: [redacted]", s)
    s = _PATTERNS[3].sub(lambda m: f"{m.group(1)}[redacted]{m.group(3)}", s)
    return s


def clip(errors: list[str]) -> list[str]:
    """At most MAX_ERRORS redacted strings of at most MAX_ERROR_CHARS each."""
    out = []
    for e in errors[:MAX_ERRORS]:
        r = redact(e)
        out.append(r if len(r) <= MAX_ERROR_CHARS else r[: MAX_ERROR_CHARS - 3] + "...")
    return out