"""Sensitive data redaction utilities for metric labels."""

from typing import Dict

# Sensitive label patterns (case-insensitive)
SENSITIVE_PATTERNS = [
    "password",
    "secret",
    "token",
    "key",
    "auth",
    "credential",
    "api_key",
    "pass",
]


def is_sensitive_label_key(key: str) -> bool:
    """
    Check if a label key matches sensitive patterns.

    Args:
        key: Label key to check

    Returns:
        True if key matches sensitive pattern, False otherwise
    """
    key_lower = key.lower()
    return any(pattern in key_lower for pattern in SENSITIVE_PATTERNS)


def redact_labels(labels: Dict[str, str]) -> Dict[str, str]:
    """
    Redact sensitive label values.

    Replaces values of labels with sensitive keys (password, secret, token, etc.)
    with "[REDACTED]". Preserves label keys for filtering purposes.

    Args:
        labels: Dictionary of label key-value pairs

    Returns:
        Dictionary with sensitive values redacted
    """
    redacted = {}
    for key, value in labels.items():
        if is_sensitive_label_key(key):
            redacted[key] = "[REDACTED]"
        else:
            redacted[key] = value
    return redacted