"""
Sensitive-value masking for onboarding API call logs (Super Admin "Export
Onboarding Logs" feature). Applied before every write to
`OnboardingApiCallLog` — never persist raw Authorization headers, tokens,
secrets, or PCI/PII-adjacent underwriting fields (bank account/routing
numbers, SSN/EIN, card numbers).
"""
from __future__ import annotations

from typing import Any

_MASK = "***MASKED***"

_SENSITIVE_HEADER_NAMES = {"authorization", "x-api-key", "cookie", "set-cookie"}

_SENSITIVE_KEYS = {
    "secret",
    "clientsecret",
    "token",
    "accesstoken",
    "refreshtoken",
    "password",
    "authorization",
    "apikey",
    "ssn",
    "tin",
    "ein",
    "accountnumber",
    "routingnumber",
    "bankaccount",
    "achaccount",
    "cardnumber",
    "cvv",
    "pin",
    # TSYS / TransIT payment-provider credentials
    "transactionkey",
    "userid",
    "deviceid",
    "developerid",
}


def _normalize(key: str) -> str:
    return key.lower().replace("_", "").replace("-", "")


def mask_headers(headers: dict | None) -> dict:
    """Case-insensitive redaction of sensitive header values."""
    if not headers:
        return {}
    return {
        k: (_MASK if _normalize(k) in _SENSITIVE_HEADER_NAMES else v)
        for k, v in headers.items()
    }


def mask_json(value: Any) -> Any:
    """Recursively redact dict values whose key matches a known sensitive field name."""
    if isinstance(value, dict):
        return {
            k: (_MASK if _normalize(str(k)) in _SENSITIVE_KEYS else mask_json(v))
            for k, v in value.items()
        }
    if isinstance(value, list):
        return [mask_json(item) for item in value]
    return value