<?php

namespace App\Helpers;

class AuditSanitizer
{
    protected static $sensitiveKeys = [
        'password',
        'cvv',
        'cvc',
        'card_number',
        'credit_card',
        'api_token',
        'access_token',
        'refresh_token',
        'otp'
    ];

    public static function clean($data)
    {
        if (!is_array($data)) {
            return $data;
        }
        $cleaned = [];

        foreach ($data as $key => $value) {
            if (self::isSensitive($key)) {
                $cleaned[$key] = '[REDACTED]';
                continue;
            }
            $cleaned[$key] = self::clean($value);
        }

        return $cleaned;
    }

    protected static function isSensitive($key)
    {
        if (!is_string($key)) {
            return false;
        }

        // Normalize key to lowercase for comparison
        $normalizedKey = strtolower($key);

        foreach (self::$sensitiveKeys as $sensitive) {
            // Exact match or contains sensitive word (optional strictness)
            if ($normalizedKey === $sensitive) {
                return true;
            }
        }

        return false;
    }
}