/**
 * Masks sensitive personal identifable information (PII) and secret keys in objects before logging.
 */
export function maskPii(data: unknown): unknown {
  if (typeof data === 'string') {
    // Email pattern
    if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data)) {
      const [user, domain] = data.split('@');
      return `${user[0]}***@${domain}`;
    }
    // Phone pattern (7+ digits)
    if (/^\+?[0-9\s\-()]{7,20}$/.test(data.trim())) {
      const clean = data.replace(/\D/g, '');
      return `***-***-${clean.slice(-4)}`;
    }
    // Token / Secrets pattern (length > 20)
    if (data.length > 25 && /^[a-zA-Z0-9_\-:]+$/.test(data)) {
      return `${data.slice(0, 4)}...${data.slice(-4)}`;
    }
    return data;
  }

  if (Array.isArray(data)) {
    return data.map(maskPii);
  }

  if (data && typeof data === 'object') {
    const masked: Record<string, unknown> = {};
    for (const [key, value] of Object.entries(data as Record<string, unknown>)) {
      const lowerKey = key.toLowerCase();
      if (
        lowerKey.includes('secret') ||
        lowerKey.includes('token') ||
        lowerKey.includes('password') ||
        lowerKey.includes('authorization') ||
        lowerKey.includes('key')
      ) {
        masked[key] = '***REDACTED***';
      } else if (lowerKey === 'em' || lowerKey === 'email') {
        masked[key] = typeof value === 'string' ? maskPii(value) : '***MASKED_EMAIL***';
      } else if (lowerKey === 'ph' || lowerKey === 'phone') {
        masked[key] = typeof value === 'string' ? maskPii(value) : '***MASKED_PHONE***';
      } else {
        masked[key] = maskPii(value);
      }
    }
    return masked;
  }

  return data;
}

export const logger = {
  info: (message: string, context?: Record<string, unknown>) => {
    console.log(`[INFO] [${new Date().toISOString()}] ${message}`, context ? JSON.stringify(maskPii(context)) : '');
  },
  warn: (message: string, context?: Record<string, unknown>) => {
    console.warn(`[WARN] [${new Date().toISOString()}] ${message}`, context ? JSON.stringify(maskPii(context)) : '');
  },
  error: (message: string, error?: unknown, context?: Record<string, unknown>) => {
    const errorMsg = error instanceof Error ? error.stack || error.message : String(error);
    console.error(`[ERROR] [${new Date().toISOString()}] ${message}`, errorMsg, context ? JSON.stringify(maskPii(context)) : '');
  },
  audit: (action: string, shopId: string, metadata?: Record<string, unknown>) => {
    console.log(`[AUDIT] [${new Date().toISOString()}] Shop: ${shopId} | Action: ${action}`, metadata ? JSON.stringify(maskPii(metadata)) : '');
  }
};