<?php
/**
 * Secret and PII redaction for every output, log and journal entry.
 *
 * @package HandyMCP
 */

namespace HandyMCP\Support;

defined( 'ABSPATH' ) || exit;

/**
 * Removes credentials and minimizes personal data.
 */
final class Redactor {

	const MASK = '[REDACTED]';

	/**
	 * Key fragments that always indicate a secret.
	 *
	 * @var string[]
	 */
	private static $secret_keys = array(
		'password', 'passwd', 'pass_', '_pass', 'pwd', 'secret', 'api_key', 'apikey', 'api-key', 'access_key',
		'private_key', 'privatekey', 'token', 'auth_key', 'auth_salt', 'logged_in_key', 'nonce_key', 'nonce_salt',
		'secure_auth', 'salt', 'client_secret', 'license_key', 'licence_key', 'smtp_pass', 'webhook_secret',
		'session_token', 'sessionid', 'cookie', 'authorization', 'credential', 'secret_key',
		'consumer_key', 'consumer_secret', 'db_password', 'app_password', 'application_password', 'refresh_token',
		'bearer', 'totp', 'recovery_code', 'card_number', 'cvv', 'cvc', 'iban', 'signature', 'accesstoken',
		'pexels_api', 'unsplash_api', 'unsplash_access',
	);

	/**
	 * Key patterns that indicate a secret: any *_key / *-key name, a
	 * one-time password, a DSN, or a PIN.
	 *
	 * @var string[]
	 */
	private static $secret_key_patterns = array(
		'/[_\-]key$/',
		'/(^|[_\-])otp($|[_\-])/',
		'/(^|[_\-])dsn($|[_\-])/',
		'/^pin$/',
	);

	/**
	 * Names ending in _key that are identifiers, not secrets.
	 *
	 * @var string[]
	 */
	private static $safe_key_names = array(
		'meta_key', 'form_key', 'field_key', 'element_key', 'widget_key', 'setting_key', 'option_key', 'sort_key',
		'cache_key', 'primary_key', 'item_key', 'cart_item_key', 'template_key', 'block_key', 'group_key', 'menu_key',
		'translation_key', 'lang_key', 'sanitize_key', 'orderby_key', 'meta_query_key', 'unique_key', 'tab_key',
	);

	/**
	 * Keys that look secret but are safe metadata.
	 *
	 * @var string[]
	 */
	private static $safe_keys = array( 'token_prefix', 'token_count', 'password_protected', 'post_password_required', 'session_tokens_count', 'has_password', 'token_endpoint', 'token_endpoint_auth_methods_supported', 'refresh_token_ttl', 'access_token_ttl', 'revoked', 'token_type' );

	/**
	 * Value patterns that indicate a credential regardless of key.
	 *
	 * @var string[]
	 */
	private static $value_patterns = array(
		'/\b(sk|rk|pk)_(live|test)_[A-Za-z0-9]{10,}\b/',
		'/\bhandymcp_[a-z]{2,4}_[A-Za-z0-9_\-]{20,}\b/',
		'/\beyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{5,}\b/',
		'/\bAKIA[0-9A-Z]{16}\b/',
		'/\bwc_order_[A-Za-z0-9]{8,}\b/',
		'/\bgh[pousr]_[A-Za-z0-9]{30,}\b/',
		'/\bxox[abpr]-[A-Za-z0-9\-]{10,}\b/',
		'/\bSG\.[A-Za-z0-9_\-]{16,}\.[A-Za-z0-9_\-]{16,}\b/',
		'/\bBearer\s+[A-Za-z0-9\-\._~\+\/]{16,}=*/i',
		'/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/',
		'/\b[A-Za-z0-9]{4} [A-Za-z0-9]{4} [A-Za-z0-9]{4} [A-Za-z0-9]{4} [A-Za-z0-9]{4} [A-Za-z0-9]{4}\b/', // WP application password format.
	);

	/**
	 * Is this key name a secret?
	 *
	 * @param string $key Key.
	 */
	public static function is_secret_key( string $key ): bool {
		$k = strtolower( $key );
		if ( in_array( $k, self::$safe_keys, true ) ) {
			return false;
		}
		foreach ( self::$secret_keys as $fragment ) {
			if ( false !== strpos( $k, $fragment ) ) {
				return true;
			}
		}
		if ( in_array( $k, self::$safe_key_names, true ) ) {
			return false;
		}
		foreach ( self::$secret_key_patterns as $pattern ) {
			if ( preg_match( $pattern, $k ) ) {
				return true;
			}
		}
		return false;
	}

	/**
	 * Is this value under a plain "key" name a credential? Forms and builders
	 * use "key" for short identifiers, so only long token-like values are masked.
	 *
	 * @param string $key   Key.
	 * @param mixed  $value Value.
	 */
	private static function is_secret_plain_key( string $key, $value ): bool {
		return 'key' === strtolower( $key ) && is_string( $value ) && strlen( $value ) >= 16 && ! preg_match( '/\s/', $value );
	}

	/**
	 * Redact secrets from a scalar string.
	 *
	 * @param string $value Value.
	 */
	public static function scrub_string( string $value ): string {
		foreach ( self::$value_patterns as $pattern ) {
			$value = (string) preg_replace( $pattern, self::MASK, $value );
		}
		// DB credentials that leak through config dumps.
		foreach ( array( 'DB_PASSWORD', 'AUTH_KEY', 'SECURE_AUTH_KEY', 'LOGGED_IN_KEY', 'NONCE_KEY', 'AUTH_SALT', 'SECURE_AUTH_SALT', 'LOGGED_IN_SALT', 'NONCE_SALT' ) as $const ) {
			$value = (string) preg_replace( "/(define\s*\(\s*['\"]" . $const . "['\"]\s*,\s*)(['\"]).*?\\2/", '$1$2' . self::MASK . '$2', $value );
			if ( defined( $const ) ) {
				$secret = (string) constant( $const );
				if ( strlen( $secret ) >= 6 ) {
					$value = str_replace( $secret, self::MASK, $value );
				}
			}
		}
		foreach ( array( 'DB_USER', 'DB_NAME', 'DB_HOST' ) as $const ) {
			$value = (string) preg_replace( "/(define\s*\(\s*['\"]" . $const . "['\"]\s*,\s*)(['\"]).*?\\2/", '$1$2' . self::MASK . '$2', $value );
		}
		return $value;
	}

	/**
	 * Recursively redact a structure.
	 *
	 * @param mixed $data  Data.
	 * @param int   $depth Recursion depth guard.
	 * @return mixed
	 */
	public static function redact( $data, int $depth = 0 ) {
		if ( $depth > 32 ) {
			return '[DEPTH_LIMIT]';
		}
		if ( is_string( $data ) ) {
			return self::scrub_string( $data );
		}
		if ( is_object( $data ) ) {
			$data = get_object_vars( $data );
		}
		if ( ! is_array( $data ) ) {
			return $data;
		}
		$out = array();
		foreach ( $data as $key => $value ) {
			// ACF field and group keys are ids, not secrets.
			if ( 'key' === $key && is_string( $value ) && preg_match( '/^(group|field|layout)_[A-Za-z0-9]{6,32}$/', $value ) ) {
				$out[ $key ] = $value;
				continue;
			}
			// On/off switches named after passwords (e.g. "disable application passwords") are not secrets.
			if ( is_string( $key ) && ( 0 === $value || 1 === $value || ( is_string( $value ) && preg_match( '/^(0|1|yes|no|on|off|true|false|enabled|disabled)$/i', $value ) ) ) && preg_match( '/(_enabled|_required)$|^(disable|enable)[a-z_]*$|_disable[a-z]*$|_(on|off)$/i', $key ) ) {
				$out[ $key ] = $value;
				continue;
			}
			if ( is_string( $key ) && self::is_secret_key( $key ) && ! is_bool( $value ) && null !== $value && '' !== $value && ! is_array( $value ) ) {
				$out[ $key ] = self::MASK;
				continue;
			}
			if ( is_string( $key ) && ( ( self::is_secret_key( $key ) && is_array( $value ) ) || self::is_secret_plain_key( $key, $value ) ) ) {
				$out[ $key ] = self::MASK;
				continue;
			}
			$out[ $key ] = self::redact( $value, $depth + 1 );
		}
		return $out;
	}

	/**
	 * Mask an email address: jane@example.com -> j***@example.com.
	 *
	 * @param string $email Email.
	 */
	public static function mask_email( string $email ): string {
		if ( ! is_email( $email ) ) {
			return $email;
		}
		list( $local, $domain ) = explode( '@', $email, 2 );
		return substr( $local, 0, 1 ) . '***@' . $domain;
	}

	/**
	 * Mask a phone number, keeping the last 3 digits.
	 *
	 * @param string $phone Phone.
	 */
	public static function mask_phone( string $phone ): string {
		$digits = preg_replace( '/\D/', '', $phone );
		if ( strlen( (string) $digits ) < 5 ) {
			return $phone;
		}
		return str_repeat( '*', strlen( (string) $digits ) - 3 ) . substr( (string) $digits, -3 );
	}

	/**
	 * Minimize customer PII in a flat array (billing / shipping / entries).
	 *
	 * @param array<string, mixed> $row  Row.
	 * @param bool                 $mask Whether masking is enabled.
	 * @return array<string, mixed>
	 */
	public static function minimize_pii( array $row, bool $mask = true ): array {
		if ( ! $mask ) {
			return self::redact( $row );
		}
		foreach ( $row as $key => $value ) {
			$k = strtolower( (string) $key );
			if ( is_array( $value ) ) {
				$row[ $key ] = self::minimize_pii( $value, $mask );
				continue;
			}
			if ( ! is_string( $value ) ) {
				continue;
			}
			if ( false !== strpos( $k, 'email' ) ) {
				$row[ $key ] = self::mask_email( $value );
			} elseif ( false !== strpos( $k, 'phone' ) || false !== strpos( $k, 'mobile' ) ) {
				$row[ $key ] = self::mask_phone( $value );
			} elseif ( preg_match( '/(address_1|address_2|street|postcode|zip|ip_address|customer_ip|user_ip|birth|ssn|tax_id|vat)/', $k ) ) {
				$row[ $key ] = '' === $value ? '' : '[PII_MINIMIZED]';
			}
		}
		return self::redact( $row );
	}
}