secrets.go

package tok

import (
	"regexp"
	"sort"
	"strings"
	"sync"
)

// SecretMatch represents a detected secret within text.
type SecretMatch struct {
	Type     string // The category/type of the secret (e.g., "AWS Access Key", "GitHub Token")
	Value    string // The matched secret value
	Masked   string // A masked version for safe display
	StartPos int    // Start byte position in the original text
	EndPos   int    // End byte position in the original text
}

// secretPattern holds a compiled regex and its associated type name.
type secretPattern struct {
	Type    string
	Pattern *regexp.Regexp
}

// SecretDetector detects and redacts secrets from text using compiled regex patterns.
type SecretDetector struct {
	patterns []secretPattern
}

var (
	defaultDetector     *SecretDetector
	defaultDetectorOnce sync.Once
)

// DefaultSecretDetector returns the singleton SecretDetector instance with all built-in patterns.
func DefaultSecretDetector() *SecretDetector {
	defaultDetectorOnce.Do(func() {
		defaultDetector = NewSecretDetector()
	})
	return defaultDetector
}

// NewSecretDetector creates a SecretDetector with all built-in patterns compiled and ready.
func NewSecretDetector() *SecretDetector {
	sd := &SecretDetector{}
	sd.patterns = compilePatterns()
	return sd
}

// compilePatterns builds and returns all secret detection patterns.
// Patterns are inspired by trufflehog's detector architecture but adapted for
// fast, local-only redaction (no network verification).
func compilePatterns() []secretPattern {
	raw := []struct {
		Type    string
		Pattern string
	}{
		// AWS Access Key ID (starts with AKIA, ASIA for temporary)
		{"AWS Access Key", `\b((?:AKIA|ASIA)[A-Z0-9]{16})\b`},
		// AWS Secret Access Key (40 char base64-like after known prefixes in context)
		{"AWS Secret Key", `(?i)(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[:=]\s*['"]?([A-Za-z0-9/+=]{40})['"]?`},

		// GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_, github_pat_)
		{"GitHub Token", `\b((?:ghp|gho|ghu|ghs|ghr|github_pat)_[a-zA-Z0-9_]{36,255})\b`},

		// GitLab Personal Access Token
		{"GitLab Token", `\b(glpat-[a-zA-Z0-9\-=_]{20,22})\b`},

		// Slack Bot Token
		{"Slack Bot Token", `(xoxb-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9\-]*)`},
		// Slack User Token
		{"Slack User Token", `(xoxp-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9\-]*)`},
		// Slack App Token
		{"Slack App Token", `(xapp-[0-9]-[A-Z0-9]+-[0-9]+-[a-zA-Z0-9]+)`},

		// JWT Token (three base64url segments separated by dots)
		{"JWT Token", `\b(eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b`},

		// Private Keys (PEM format)
		{"RSA Private Key", `(-----BEGIN RSA PRIVATE KEY-----[\s\S]*?-----END RSA PRIVATE KEY-----)`},
		{"EC Private Key", `(-----BEGIN EC PRIVATE KEY-----[\s\S]*?-----END EC PRIVATE KEY-----)`},
		{"OpenSSH Private Key", `(-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----)`},
		{"Private Key", `(-----BEGIN PRIVATE KEY-----[\s\S]*?-----END PRIVATE KEY-----)`},

		// Database Connection Strings
		{"Database Connection String", `(?i)((?:postgres|mysql|mongodb|redis|amqp|mssql)://[^\s'"` + "`" + `]{10,})`},

		// Stripe Keys
		{"Stripe Secret Key", `\b([rs]k_live_[a-zA-Z0-9]{20,247})\b`},
		{"Stripe Publishable Key", `\b(pk_live_[a-zA-Z0-9]{20,247})\b`},

		// SendGrid API Key
		{"SendGrid API Key", `\b(SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43})\b`},

		// Twilio Account SID and Auth Token
		{"Twilio Account SID", `\b(AC[a-f0-9]{32})\b`},
		{"Twilio Auth Token", `(?i)(?:twilio_auth_token|twilio_token|auth_token)\s*[:=]\s*['"]?([a-f0-9]{32})['"]?`},

		// Heroku API Key
		{"Heroku API Key", `(?i)(?:heroku_api_key|heroku_key|HEROKU_API_KEY)\s*[:=]\s*['"]?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})['"]?`},

		// DigitalOcean
		{"DigitalOcean Token", `\b(dop_v1_[a-f0-9]{64})\b`},
		{"DigitalOcean OAuth Token", `\b(doo_v1_[a-f0-9]{64})\b`},
		{"DigitalOcean Refresh Token", `\b(dor_v1_[a-f0-9]{64})\b`},

		// Anthropic API Key
		{"Anthropic API Key", `\b(sk-ant-(?:admin01|api03)-[\w\-]{80,100})\b`},

		// OpenAI API Key
		{"OpenAI API Key", `\b(sk-(?:proj-)?[A-Za-z0-9_-]{32,}T3BlbkFJ[A-Za-z0-9_-]+)\b`},

		// Google API Key
		{"Google API Key", `\b(AIza[A-Za-z0-9_-]{35})\b`},

		// Azure Storage/Subscription Key
		{"Azure Key", `(?i)(?:azure|subscription)[_\-]?(?:key|secret|password)\s*[:=]\s*['"]?([A-Za-z0-9+/=]{32,88})['"]?`},

		// npm Token
		{"npm Token", `\b(npm_[a-zA-Z0-9]{36})\b`},

		// PyPI Token
		{"PyPI Token", `\b(pypi-[A-Za-z0-9_-]{50,})\b`},

		// Docker Registry Token (config auth)
		{"Docker Registry Token", `(?i)"auth"\s*:\s*"([A-Za-z0-9+/=]{20,})"`},

		// Generic API key patterns (commonly assigned to variables named "api_key", "apikey", etc.)
		{"Generic API Key", `(?i)(?:api_key|apikey|api-key|access_key|secret_key|auth_token|access_token)\s*[:=]\s*['"]([A-Za-z0-9_\-./+=]{20,64})['"]`},

		// Generic Secret assignment (commonly "secret", "password", "passwd" in config)
		{"Generic Secret", `(?i)(?:secret|password|passwd|pwd)\s*[:=]\s*['"]([^\s'"]{8,64})['"]`},
	}

	patterns := make([]secretPattern, 0, len(raw))
	for _, r := range raw {
		compiled := regexp.MustCompile(r.Pattern)
		patterns = append(patterns, secretPattern{
			Type:    r.Type,
			Pattern: compiled,
		})
	}
	return patterns
}

// DetectSecrets scans the input text and returns all detected secret matches.
// Matches are returned sorted by StartPos in ascending order.
func (sd *SecretDetector) DetectSecrets(text string) []SecretMatch {
	if text == "" {
		return nil
	}

	var matches []SecretMatch
	seen := make(map[string]bool) // Deduplicate overlapping matches for same value

	for _, sp := range sd.patterns {
		locs := sp.Pattern.FindAllStringSubmatchIndex(text, -1)
		for _, loc := range locs {
			// Use the first capturing group if available, otherwise the full match
			startIdx, endIdx := loc[0], loc[1]
			if len(loc) >= 4 && loc[2] >= 0 {
				startIdx, endIdx = loc[2], loc[3]
			}

			value := text[startIdx:endIdx]

			// Deduplicate: same value at same position
			key := value + ":" + sp.Type
			if seen[key] {
				continue
			}
			seen[key] = true

			matches = append(matches, SecretMatch{
				Type:     sp.Type,
				Value:    value,
				Masked:   maskSecret(value, sp.Type),
				StartPos: startIdx,
				EndPos:   endIdx,
			})
		}
	}

	// Sort by position for stable output and correct redaction ordering
	sort.Slice(matches, func(i, j int) bool {
		return matches[i].StartPos < matches[j].StartPos
	})

	return matches
}

// RedactSecrets replaces all detected secrets in the text with [REDACTED:<type>] placeholders.
func (sd *SecretDetector) RedactSecrets(text string) string {
	if text == "" {
		return ""
	}

	matches := sd.DetectSecrets(text)
	if len(matches) == 0 {
		return text
	}

	// Build the result by replacing matched regions, processing from end to start
	// to preserve byte offsets.
	result := text
	// Process in reverse order so byte positions remain valid
	for i := len(matches) - 1; i >= 0; i-- {
		m := matches[i]
		replacement := "[REDACTED:" + m.Type + "]"
		result = result[:m.StartPos] + replacement + result[m.EndPos:]
	}

	return result
}

// DetectAndRedactWithEntropy performs secret detection using both patterns and entropy analysis.
// It applies entropy-based detection for segments that match a generic high-entropy pattern
// but were not caught by specific detectors.
func (sd *SecretDetector) DetectAndRedactWithEntropy(text string, entropyThreshold float64) string {
	// First, apply pattern-based redaction
	result := sd.RedactSecrets(text)

	// Then scan for high-entropy strings that might be unknown secret formats.
	// Look for quoted strings or assignment values that have high entropy.
	highEntropyPat := regexp.MustCompile(`(?i)(?:key|token|secret|password|credential|auth)\s*[:=]\s*['"]?([A-Za-z0-9+/=_\-]{16,})['"]?`)
	locs := highEntropyPat.FindAllStringSubmatchIndex(result, -1)

	// Process in reverse to maintain positions
	for i := len(locs) - 1; i >= 0; i-- {
		loc := locs[i]
		if len(loc) < 4 || loc[2] < 0 {
			continue
		}
		value := result[loc[2]:loc[3]]

		// Skip if already redacted
		if strings.Contains(value, "[REDACTED:") {
			continue
		}

		if IsHighEntropy(value, entropyThreshold) {
			replacement := "[REDACTED:High Entropy]"
			result = result[:loc[2]] + replacement + result[loc[3]:]
		}
	}

	return result
}

// maskSecret creates a masked version of the secret, preserving a prefix for identification
// while hiding the sensitive portion.
func maskSecret(value string, secretType string) string {
	if len(value) == 0 {
		return ""
	}

	// For private keys, just show the header
	if strings.HasPrefix(value, "-----BEGIN") {
		lines := strings.SplitN(value, "\n", 2)
		if len(lines) > 0 {
			return lines[0] + "...[REDACTED]"
		}
	}

	// For tokens with a known prefix, show the prefix
	prefixes := []string{
		"ghp_", "gho_", "ghu_", "ghs_", "ghr_", "github_pat_",
		"glpat-",
		"xoxb-", "xoxp-", "xapp-",
		"sk_live_", "rk_live_", "pk_live_",
		"SG.",
		"dop_v1_", "doo_v1_", "dor_v1_",
		"sk-ant-", "sk-proj-", "sk-",
		"AIza",
		"npm_",
		"pypi-",
		"AKIA", "ASIA",
		"AC",
	}

	for _, prefix := range prefixes {
		if strings.HasPrefix(value, prefix) {
			showLen := len(prefix) + 4
			if showLen > len(value) {
				showLen = len(value)
			}
			return value[:showLen] + "..." + strings.Repeat("*", 8)
		}
	}

	// Generic masking: show first 4 and last 4 characters
	if len(value) > 12 {
		return value[:4] + "..." + strings.Repeat("*", 8) + "..." + value[len(value)-4:]
	}

	return strings.Repeat("*", len(value))
}