secrets.go

package tok

import (
	"sync"

	"github.com/GrayCodeAI/tok/internal/secrets"
)

// SecretMatch represents a detected secret within text.
type SecretMatch = secrets.SecretMatch

// SecretDetector detects and redacts secrets from text using compiled regex patterns.
type SecretDetector struct {
	inner *secrets.SecretDetector
}

var (
	defaultDetector     *SecretDetector
	defaultDetectorOnce sync.Once
)

// DefaultSecretDetector returns the singleton SecretDetector instance with all built-in patterns.
// It is safe for concurrent use.
func DefaultSecretDetector() *SecretDetector {
	defaultDetectorOnce.Do(func() {
		defaultDetector = &SecretDetector{inner: secrets.DefaultDetector()}
	})
	return defaultDetector
}

// NewSecretDetector creates a SecretDetector with all built-in patterns compiled and ready.
func NewSecretDetector() *SecretDetector {
	return &SecretDetector{inner: secrets.NewDetector()}
}

// DetectSecrets finds all secrets in the given text.
func (sd *SecretDetector) DetectSecrets(text string) []SecretMatch {
	return sd.inner.DetectSecrets(text)
}

// RedactSecrets replaces detected secrets with [REDACTED] markers.
func (sd *SecretDetector) RedactSecrets(text string) string {
	return sd.inner.RedactSecrets(text)
}

// DetectAndRedactWithEntropy detects secrets using both pattern matching and entropy analysis.
func (sd *SecretDetector) DetectAndRedactWithEntropy(text string, entropyThreshold float64) string {
	return sd.inner.DetectAndRedactWithEntropy(text, entropyThreshold)
}

// MaskSecret masks a secret value for safe display.
func MaskSecret(value, secretType string) string {
	return secrets.MaskSecret(value, secretType)
}