#!/bin/sh
# avasis redact (shell wrapper): strip paths, hostnames, tokens, emails and IPs from error text BEFORE it leaves your machine.
#   some-command 2>&1 | sh redact.sh          pbpaste | sh redact.sh | pbcopy          sh redact.sh error.log
# Downloads nothing, no network. Uses node with redact.js when both are present (same rule list as the server);
# otherwise the perl below (present on every Mac and most Linux boxes) with the same rules plus this machine's own
# username, hostname and home directory. Read the output before you paste it anywhere. docs/security/REDACTION.md
set -eu
DIR="$(cd "$(dirname "$0")" && pwd)"
if command -v node >/dev/null 2>&1 && [ -f "$DIR/redact.js" ]; then
  exec node "$DIR/redact.js" "$@"
fi
AV_USER="$(id -un 2>/dev/null || echo "")" AV_HOST="$(hostname -s 2>/dev/null || hostname 2>/dev/null || echo "")" AV_HOME="${HOME:-}" \
exec perl -0777 -pe '
  my %keep = map { $_ => 1 } qw(127.0.0.1 0.0.0.0 ::1 1.1.1.1 8.8.8.8);
  s/-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----/[redacted:private-key]/gs;
  s{https://hooks\.slack\.com/services/[A-Za-z0-9/_-]+|https://(?:ptb\.|canary\.)?discord(?:app)?\.com/api/webhooks/\d+/[A-Za-z0-9_-]+}{[redacted:webhook]}g;
  s/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/[redacted:jwt]/g;
  s/\b(?:sk-ant-|sk-(?:proj-|live-|test-)?|sk_(?:live|test)_|rk_(?:live|test)_|xox[abprs]-|gh[pousr]_|github_pat_|glpat-|AKIA|ASIA|AIza|avx_|avs_|npm_|pypi-|dop_v1_|hf_)[A-Za-z0-9_-]{8,}/[redacted:api-key]/g;
  s/\b(bearer|token|basic)\s+[A-Za-z0-9._\-+\/=]{16,}/$1 [redacted]/gi;
  s/\b((?:api[_-]?key|secret|password|passwd|pwd|token|auth|credential)s?)(\s*[=:]\s*)["\x27]?[^\s"\x27&,;]{6,}/${1}${2}[redacted]/gi;
  s{\b(https?|postgres(?:ql)?|mysql|redis|mongodb(?:\+srv)?|amqp|ssh|ftp)://[^\s/:@]+:[^\s/@]+@}{$1://[redacted]@}gi;
  s/\b(?!git@(?:github\.com|gitlab\.com|bitbucket\.org|codeberg\.org)\b)[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/[redacted:email]/gi;
  s{(?<![\w.])(?:/Users|/home|/export/home)/[^/\s"\x27`:]+}{~}g;
  s/\b[A-Z]:\\Users\\[^\\\s"\x27]+/%USERPROFILE%/gi;
  s{/private/var/folders/[^\s"\x27`]+|/var/folders/[^\s"\x27`]+}{/var/folders/[redacted]}g;
  s/(?<![\w:])(?=[0-9a-fA-F:]*(?:[a-fA-F]|::))((?:[0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{1,4})(?![\w:])/$keep{$1} ? $1 : "[redacted:ipv6]"/ge;
  s/\b((?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d))\b/$keep{$1} ? $1 : "[redacted:ip]"/ge;
  s/\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b/[redacted:mac]/g;
  s/\b[A-Za-z0-9-]+\.(?:local|lan|internal|corp|intranet|home|localdomain)\b/[redacted:host]/g;
  s/\b[0-9a-f]{32,}\b/[redacted:hex]/g;
  for my $own ([$ENV{AV_HOME}, "~"], [$ENV{AV_HOST}, "[redacted:host]"], [$ENV{AV_USER}, "[redacted:user]"]) {
    my ($n, $r) = @$own; next unless defined $n && length($n) >= 4;
    s/(?<![\w-])\Q$n\E(?![\w-])/$r/g;
  }
  END { print STDERR "avasis redact: done (perl; install node for the summary)\n" }
' "$@"