bouncer

var (
	// ErrInvalidToken indicates the provided token is invalid.
	ErrInvalidToken = errors.New("invalid token")
	// ErrExpiredToken indicates the provided token has expired.
	ErrExpiredToken = errors.New("expired token")
	// ErrMissingToken indicates no token was provided.
	ErrMissingToken = errors.New("missing token")
)

var BuiltInPatterns = []SecretPattern{
	{
		Name:        "aws-access-key",
		Pattern:     regexp.MustCompile(`AKIA[0-9A-Z]{16}`),
		Example:     "AKIAIOSFODNN7EXAMPLE",
		Description: "AWS Access Key ID (20 characters, starts with AKIA)",
	},
	{
		Name:        "github-classic-pat",
		Pattern:     regexp.MustCompile(`ghp_[A-Za-z0-9]{36}`),
		Example:     "ghp_abcdefghijklmnopqrstuvwxyz1234567890abcd",
		Description: "GitHub Classic Personal Access Token (starts with ghp_)",
	},
	{
		Name:        "github-fine-grained-pat",
		Pattern:     regexp.MustCompile(`github_pat_[A-Za-z0-9_]{22,}`),
		Example:     "github_pat_11abcdefghIJ9xsQ_xxxxxxxxxxxxxxxxx",
		Description: "GitHub Fine-grained PAT (starts with github_pat_)",
	},
	{
		Name:        "stripe-secret-key",
		Pattern:     regexp.MustCompile(`sk_live_[A-Za-z0-9]{24}`),
		Example:     "[Stripe Live Secret Key - 24 chars after sk_live_]",
		Description: "Stripe Live Secret Key (starts with sk_live_)",
	},
	{
		Name:        "stripe-publishable-key",
		Pattern:     regexp.MustCompile(`pk_live_[A-Za-z0-9]{24}`),
		Example:     "[Stripe Publishable Key - 24 chars after pk_live_]",
		Description: "Stripe Live Publishable Key (starts with pk_live_)",
	},
	{
		Name:        "generic-api-key",
		Pattern:     regexp.MustCompile(`(?i)(api[_-]?key)[_-]?[=]?[A-Za-z0-9]{16,}`),
		Example:     "api_key=abcdefghijklmnopqrstuvwx",
		Description: "Generic API key pattern (case-insensitive)",
	},
	{
		Name:        "bearer-token",
		Pattern:     regexp.MustCompile(`(?i)bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+`),
		Example:     "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
		Description: "JWT Bearer token (three base64url segments)",
	},
	{
		Name:        "env-var-value",
		Pattern:     regexp.MustCompile(`\$[A-Z_][A-Z0-9_]{0,30}=([^\s,}]+)`),
		Example:     "$API_KEY=secret123",
		Description: "Environment variable assignment",
	},
}

var (
	ErrDangerousPattern = errors.New("dangerous regex pattern detected")
)