/**
 * Basic content filter for AI outputs.
 * Flags potentially problematic content and redacts sensitive data.
 *
 * EGAI 4.3.2.1 — AI Output Content Check
 */

const SENSITIVE_PATTERNS = [
  /password\s*[:=]\s*\S+/gi,
  /api[_-]?key\s*[:=]\s*\S+/gi,
  /secret\s*[:=]\s*\S+/gi,
  /bearer\s+[a-zA-Z0-9._-]{20,}/gi,
  /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY/gi,
];

export function checkAiOutput(output: string): { clean: boolean; redacted: string } {
  let redacted = output;
  let clean = true;
  for (const pattern of SENSITIVE_PATTERNS) {
    if (pattern.test(redacted)) {
      clean = false;
      // Reset lastIndex since we used the `g` flag for test()
      pattern.lastIndex = 0;
      redacted = redacted.replace(pattern, "[REDACTED]");
    }
  }
  return { clean, redacted };
}
