<?php
namespace App\Support\Security;

final class Redactor
{
    private const SENSITIVE_KEYS = [
        'authorization','cookie','set-cookie','x-api-key','x-api-signature','api_secret','secret',
        'private_key','seed','mnemonic','password','password_confirmation','two_factor_secret',
        'two_factor_code','token','refresh_token','access_token','passport','ssn',
    ];

    public static function redact(array $context): array
    {
        $walk = function (mixed $value, string $key = '') use (&$walk): mixed {
            if (in_array(strtolower($key), self::SENSITIVE_KEYS, true)) {
                return '[REDACTED]';
            }
            if (is_array($value)) {
                $out = [];
                foreach ($value as $k => $v) {
                    $out[$k] = $walk($v, (string) $k);
                }
                return $out;
            }
            return $value;
        };
        return $walk($context);
    }
}
