package secrets

import "strings"

const Redacted = "REDACTED"

// RedactDiagnosticFields removes known credential/header values before a
// diagnostics boundary. Callers must still avoid passing raw values at all.
func RedactDiagnosticFields(fields map[string]string) map[string]string {
	redacted := make(map[string]string, len(fields))
	for key, value := range fields {
		if isSensitiveDiagnosticField(key) {
			redacted[key] = Redacted
			continue
		}
		redacted[key] = value
	}
	return redacted
}

func isSensitiveDiagnosticField(key string) bool {
	key = strings.ToLower(strings.TrimSpace(key))
	return key == "authorization" || key == "proxy-authorization" || strings.Contains(key, "secret") || strings.Contains(key, "token") || strings.Contains(key, "password") || strings.Contains(key, "credential")
}