spb/market-atlas

1const SECRET_KEYS = /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|token|access[-_]?token|refresh[-_]?token|session(id)?|csrf|x-csrf-token|password|secret|private[-_]?key)$/i;2const SECRET_QUERY = /([?&](api_?key|token|key|secret|session|sig|signature|auth)=)[^&#]+/gi;34/** Removes secrets from a URL query string. */5export function redactUrl(url: string): string {6  return url.replace(SECRET_QUERY, "$1[redacted]");7}89/** Deep-copies an object removing secret-looking keys (headers, cookies, tokens). */10export function redactObject<T>(value: T, depth = 0): T {11  if (depth > 12) return value;12  if (Array.isArray(value)) return value.map((v) => redactObject(v, depth + 1)) as T;13  if (value && typeof value === "object") {14    const out: Record<string, unknown> = {};15    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {16      out[k] = SECRET_KEYS.test(k) ? "[redacted]" : redactObject(v, depth + 1);17    }18    return out as T;19  }20  if (typeof value === "string" && value.length > 20 && /^(Bearer|Basic)\s/i.test(value)) return "[redacted]" as T;21  return value;22}23