"""AegisTrade AI Audit Logging & Security Redaction."""
from __future__ import annotations

import json
import logging
import re
import sys
from datetime import datetime, timezone
from typing import Any

SENSITIVE_PATTERNS = [
    re.compile(r"(api[_-]?key[\"']?\s*[:=]\s*[\"']?)([a-zA-Z0-9_\-]{6,})([\"']?)", re.IGNORECASE),
    re.compile(r"(secret[\"']?\s*[:=]\s*[\"']?)([a-zA-Z0-9_\-]{6,})([\"']?)", re.IGNORECASE),
    re.compile(r"(password[\"']?\s*[:=]\s*[\"']?)([^\s\"',]+)([\"']?)", re.IGNORECASE),
    re.compile(r"(bearer\s+)([a-zA-Z0-9_\-\.]{10,})()", re.IGNORECASE),
    re.compile(r"(token[\"']?\s*[:=]\s*[\"']?)([a-zA-Z0-9_\-\.]{8,})([\"']?)", re.IGNORECASE),
]


def redact_sensitive_data(message: str) -> str:
    """Mask credentials and secrets from logs and error strings."""
    redacted = message
    for pattern in SENSITIVE_PATTERNS:
        redacted = pattern.sub(r"\1***REDACTED***\3", redacted)
    return redacted


class JSONFormatter(logging.Formatter):
    """Structured JSON formatter with automated secret redaction."""

    def format(self, record: logging.LogRecord) -> str:
        log_obj: dict[str, Any] = {
            "timestamp": datetime.now(timezone.utc).isoformat(),
            "level": record.levelname,
            "logger": record.name,
            "message": redact_sensitive_data(record.getMessage()),
        }
        if record.exc_info:
            log_obj["exception"] = redact_sensitive_data(self.formatException(record.exc_info))
        if hasattr(record, "extra") and isinstance(record.extra, dict):  # type: ignore
            log_obj["extra"] = record.extra  # type: ignore
        return json.dumps(log_obj)


def setup_logger(name: str = "aegistrade", level: str = "INFO") -> logging.Logger:
    logger = logging.getLogger(name)
    logger.setLevel(getattr(logging, level.upper(), logging.INFO))
    logger.propagate = False

    if not logger.handlers:
        handler = logging.StreamHandler(sys.stdout)
        handler.setFormatter(JSONFormatter())
        logger.addHandler(handler)

    return logger


audit_logger = setup_logger("aegistrade.audit")