package utils

import (
	"net/url"
	"strings"
)

const (
	redactedQueryValue     = "redacted"
	redactedURIPlaceholder = "<redacted-uri>"
)

// RedactSourceURI removes sensitive query parameters from cloud storage URIs before audit logging.
func RedactSourceURI(sourceURI string) string {
	if sourceURI == "" {
		return ""
	}

	u, err := url.Parse(sourceURI)
	if err != nil {
		lower := strings.ToLower(sourceURI)
		if strings.Contains(lower, "sas-token=") || strings.Contains(lower, "secret-access-key=") {
			return redactedURIPlaceholder
		}
		return sourceURI
	}

	q, qerr := url.ParseQuery(u.RawQuery)
	if qerr != nil {
		lower := strings.ToLower(u.RawQuery)
		if strings.Contains(lower, "sas-token=") || strings.Contains(lower, "secret-access-key=") {
			return redactedURIPlaceholder
		}
		return sourceURI
	}

	changed := false
	for k := range q {
		if strings.EqualFold(k, "sas-token") || strings.EqualFold(k, "secret-access-key") {
			q.Set(k, redactedQueryValue)
			changed = true
		}
	}
	if changed {
		u.RawQuery = q.Encode()
	}
	if u.Fragment != "" {
		u.Fragment = ""
	}
	return u.String()
}