mxaccessgw/clients/dotnet/ZB.MOM.WW.MxGateway.Client/MxGatewaySecretRedaction.cs

namespace ZB.MOM.WW.MxGateway.Client;

/// <summary>
/// Scrubs exact secret substrings out of diagnostic text before it leaves the client on an
/// exception path. MXAccess can echo a submitted credential or secured value back inside a
/// failure diagnostic (protocol message, MXSTATUS_PROXY diagnostic text, HRESULT description);
/// this helper replaces any such verbatim occurrence with <c>&lt;redacted&gt;</c> so the raw
/// request payload never reaches a caught exception's message. The marker matches the Go, Rust,
/// and Java clients.
/// </summary>
internal static class MxGatewaySecretRedaction
{
    private const string Marker = "<redacted>";

    /// <summary>
    /// Replaces every non-null, non-empty secret in <paramref name="secrets"/> with the
    /// redaction marker (ordinal comparison). Returns the message unchanged when it is null or
    /// empty, or when no usable secret is supplied.
    /// </summary>
    /// <param name="message">The diagnostic message to scrub.</param>
    /// <param name="secrets">The secret values to remove from the message.</param>
    /// <returns>The scrubbed message.</returns>
    internal static string Redact(string message, params string?[] secrets)
    {
        if (string.IsNullOrEmpty(message) || secrets is null)
        {
            return message;
        }

        string result = message;
        foreach (string? secret in secrets)
        {
            if (!string.IsNullOrEmpty(secret))
            {
                result = result.Replace(secret, Marker, StringComparison.Ordinal);
            }
        }

        return result;
    }

    /// <summary>
    /// Returns an exception equivalent to <paramref name="ex"/> but with any verbatim secret
    /// scrubbed from its message. When nothing changes, the original exception is returned
    /// unchanged; otherwise a new exception of the same concrete runtime type is built and the
    /// original reply/status context is preserved. The secret-bearing original is deliberately
    /// <b>not</b> chained as the inner exception — doing so would let its unredacted message
    /// re-surface through <see cref="Exception.ToString"/> (which logging frameworks call). The
    /// original's own inner cause (a transport error, never the request payload) is carried
    /// forward instead.
    /// </summary>
    /// <param name="ex">The exception to redact.</param>
    /// <param name="secrets">The secret values to remove from the message.</param>
    /// <returns>The redacted exception, or the original when no change was needed.</returns>
    internal static MxGatewayException Redacted(MxGatewayException ex, params string?[] secrets)
    {
        ArgumentNullException.ThrowIfNull(ex);

        string redacted = Redact(ex.Message, secrets);
        if (string.Equals(redacted, ex.Message, StringComparison.Ordinal))
        {
            return ex;
        }

        Exception? cause = ex.InnerException;
        return ex switch
        {
            MxAccessException access => new MxAccessException(redacted, access.Reply, cause),
            MxGatewaySessionException => new MxGatewaySessionException(
                redacted, ex.SessionId, ex.CorrelationId, ex.ProtocolStatus, ex.HResultCode, ex.Statuses, cause),
            MxGatewayWorkerException => new MxGatewayWorkerException(
                redacted, ex.SessionId, ex.CorrelationId, ex.ProtocolStatus, ex.HResultCode, ex.Statuses, cause),
            MxGatewayAuthenticationException => new MxGatewayAuthenticationException(
                redacted, ex.SessionId, ex.CorrelationId, ex.ProtocolStatus, ex.HResultCode, ex.Statuses, cause),
            MxGatewayAuthorizationException => new MxGatewayAuthorizationException(
                redacted, ex.SessionId, ex.CorrelationId, ex.ProtocolStatus, ex.HResultCode, ex.Statuses, cause),
            MxGatewayMalformedReplyException => new MxGatewayMalformedReplyException(
                redacted, ex.SessionId, ex.CorrelationId, ex.ProtocolStatus, ex.HResultCode, ex.Statuses, cause),
            MxGatewayCommandException => new MxGatewayCommandException(
                redacted, ex.SessionId, ex.CorrelationId, ex.ProtocolStatus, ex.HResultCode, ex.Statuses, cause),
            _ => new MxGatewayException(redacted, cause),
        };
    }
}