"""Redaksi data sensitif sebelum disimpan ke log/database."""
import re

_KV = re.compile(
    r"(?i)\b(password|passwd|pwd|pass|token|secret|api[_-]?key|authorization|cookie|set-cookie|session(?:id)?|csrf)"
    r"(\s*[=:]\s*)([^&\s;,]+)"
)
_BEARER = re.compile(r"(?i)\b(bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}")
_JWT = re.compile(r"\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{5,}\b")

MAX_LEN = 500


def redact(text: str | None, max_len: int = MAX_LEN) -> str:
    if not text:
        return ""
    out = _BEARER.sub(lambda m: f"{m.group(1)} [REDACTED]", text)
    out = _JWT.sub("[REDACTED_JWT]", out)
    out = _KV.sub(lambda m: f"{m.group(1)}{m.group(2)}[REDACTED]", out)
    out = "".join(ch if ch.isprintable() else " " for ch in out)
    return out[:max_len]