namespace ZB.MOM.WW.MxGateway.Client.Cli;

/// <summary>Utility to redact secrets (API keys, MXAccess credentials) from error messages for safe output.</summary>
internal static class MxGatewayCliSecretRedactor
{
    /// <summary>
    /// Replaces every occurrence of any supplied secret in the value with a
    /// redacted placeholder. Null or empty secrets are ignored, so callers can
    /// pass optional credentials without pre-filtering.
    /// </summary>
    /// <param name="value">The message text to redact.</param>
    /// <param name="secrets">The secret values to remove (API key, verify-user password, secured payloads).</param>
    public static string Redact(string value, params string?[] secrets)
    {
        if (string.IsNullOrEmpty(value) || secrets is null)
        {
            return value;
        }

        string redacted = value;
        foreach (string? secret in secrets)
        {
            if (!string.IsNullOrEmpty(secret))
            {
                redacted = redacted.Replace(secret, "[redacted]", StringComparison.Ordinal);
            }
        }

        return redacted;
    }
}