// Copyright 2024 RustFS Team
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

use rustfs_security_governance::{RedactionLevel, RedactionPolicyError, RedactionRule, validate_redaction_rules};
pub use rustfs_utils::MaskedAccessKey;

pub const REDACTED_LOG_VALUE: &str = "***redacted***";

pub const LOGGING_REDACTION_RULES: &[RedactionRule] = &[
    RedactionRule::new("access_key", RedactionLevel::Sensitive, "principal identifiers should be masked in logs"),
    RedactionRule::new(
        "authorization",
        RedactionLevel::Secret,
        "authorization headers may carry bearer or signature material",
    ),
    RedactionRule::new(
        "client_secret",
        RedactionLevel::Secret,
        "OIDC and external provider client secrets must never be logged",
    ),
    RedactionRule::new("secret_key", RedactionLevel::Secret, "secret access keys must never be logged"),
    RedactionRule::new(
        "session_token",
        RedactionLevel::Secret,
        "session tokens can be replayed if exposed in logs",
    ),
    RedactionRule::new("token", RedactionLevel::Secret, "generic token fields are treated as secret by default"),
];

pub fn validate_logging_redaction_rules() -> Result<(), RedactionPolicyError> {
    validate_redaction_rules(LOGGING_REDACTION_RULES)
}

pub fn is_sensitive_log_field(field_name: &str) -> bool {
    LOGGING_REDACTION_RULES
        .iter()
        .any(|rule| rule.field().eq_ignore_ascii_case(field_name.trim()) && rule.level().requires_redaction())
}

pub fn redacted_log_value(value: &str) -> &'static str {
    if value.is_empty() { "" } else { REDACTED_LOG_VALUE }
}

pub fn redacted_optional_log_value(value: Option<&str>) -> Option<&'static str> {
    value.map(redacted_log_value)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn logging_redaction_rules_are_valid() {
        assert!(validate_logging_redaction_rules().is_ok());
    }

    #[test]
    fn identifies_sensitive_log_fields_case_insensitively() {
        assert!(is_sensitive_log_field("access_key"));
        assert!(is_sensitive_log_field("Authorization"));
        assert!(is_sensitive_log_field("session_token"));
        assert!(!is_sensitive_log_field("bucket"));
        assert!(!is_sensitive_log_field("status_code"));
    }

    #[test]
    fn redacted_log_value_preserves_empty_values() {
        assert_eq!(redacted_log_value(""), "");
        assert_eq!(redacted_log_value("secret"), REDACTED_LOG_VALUE);
        assert_eq!(redacted_optional_log_value(None), None);
        assert_eq!(redacted_optional_log_value(Some("")), Some(""));
        assert_eq!(redacted_optional_log_value(Some("secret")), Some(REDACTED_LOG_VALUE));
    }

    #[test]
    fn masked_access_key_masks_short_values() {
        assert_eq!(MaskedAccessKey("").to_string(), "");
        assert_eq!(MaskedAccessKey("a").to_string(), "***");
        assert_eq!(MaskedAccessKey("abcd").to_string(), "***");
        assert_eq!(MaskedAccessKey("abcde").to_string(), "a***e");
        assert_eq!(MaskedAccessKey("abcdefgh").to_string(), "a***h");
    }

    #[test]
    fn masked_access_key_masks_long_values() {
        assert_eq!(MaskedAccessKey("AKIAIOSFODNN7EXAMPLE").to_string(), "AKIA***MPLE");
        assert_eq!(format!("{:?}", MaskedAccessKey("keystone:user-1234")), "keys***1234");
    }
}