<?php

namespace Simplyin\Simplyin_W_Plugin\Helper;

final class Log_Sanitizer {

	private const SENSITIVE_KEYS = [
		'auth_token',
		'authToken',
		'notification_token_id',
		'notificationTokenId',
		'merchantToken',
		'apiKey',
		'api_key',
		'merchantApiKey',
		'X-Auth-Merchant-Api-Key',
		// RSA request-signing headers (Plugin_Rsa_Signer): the signature and
		// credential id enable replay of signed requests if logs leak, so the
		// whole signing header set is redacted from WP_DEBUG request logs.
		'X-Auth-Merchant-Credential-Id',
		'X-Auth-Merchant-Signature',
		'X-Auth-Merchant-Timestamp',
		'X-Auth-Merchant-Nonce',
		// Per-shop HMAC webhook signing secret (delivered in the plugin/sync response and its
		// stored option key) — sensitive and must never leak to debug logs.
		'paymentWebhookSigningSecret',
		'simplyin_plugin_payment_webhook_secret',
	];

	public static function mask( array $data ): array {
		array_walk_recursive( $data, static function ( &$value, $key ) {
			if ( in_array( $key, self::SENSITIVE_KEYS, true ) && ! empty( $value ) ) {
				$value = '[REDACTED]';
			}
		} );
		return $data;
	}
}
