bouncer

var (
	// ErrInvalidToken indicates the provided token is invalid.
	ErrInvalidToken = errors.New("invalid token")
	// ErrExpiredToken indicates the provided token has expired.
	ErrExpiredToken = errors.New("expired token")
	// ErrMissingToken indicates no token was provided.
	ErrMissingToken = errors.New("missing token")
)

var BuiltInPatterns = []SecretPattern{
	{
		Name:        "aws-access-key",
		Pattern:     regexp.MustCompile(`AKIA[0-9A-Z]{16}`),
		Example:     "AKIAIOSFODNN7EXAMPLE",
		Description: "AWS Access Key ID (20 characters, starts with AKIA)",
	},
	{
		Name:        "github-classic-pat",
		Pattern:     regexp.MustCompile(`ghp_[A-Za-z0-9]{36,}`),
		Example:     "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
		Description: "GitHub Classic Personal Access Token (starts with ghp_, 36+ chars after prefix)",
	},
	{
		Name:        "github-fine-grained-pat",
		Pattern:     regexp.MustCompile(`github_pat_[A-Za-z0-9_]{22,}`),
		Example:     "github_pat_11XXXXXXXXXXXXXXXX_XXXXXXXXXXXXXXXXXXXX",
		Description: "GitHub Fine-grained PAT (starts with github_pat_)",
	},
	{
		Name:        "stripe-secret-key",
		Pattern:     regexp.MustCompile(`sk_live_[A-Za-z0-9]{24}`),
		Example:     "[Stripe Live Secret Key - 24 chars after sk_live_]",
		Description: "Stripe Live Secret Key (starts with sk_live_)",
	},
	{
		Name:        "stripe-publishable-key",
		Pattern:     regexp.MustCompile(`pk_live_[A-Za-z0-9]{24}`),
		Example:     "[Stripe Publishable Key - 24 chars after pk_live_]",
		Description: "Stripe Live Publishable Key (starts with pk_live_)",
	},
	{
		Name:        "pem-private-key",
		Pattern:     regexp.MustCompile(`-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----[\s\S]+?-----END (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----`),
		Example:     "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQ...\n-----END RSA PRIVATE KEY-----",
		Description: "Multi-line PEM-encoded private keys (RSA, EC, DSA, OpenSSH, PKCS8, encrypted)",
	},
	{
		Name:        "pem-certificate",
		Pattern:     regexp.MustCompile(`-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----`),
		Example:     "-----BEGIN CERTIFICATE-----\nMIIDdzCCAl+gAwIBAgI...\n-----END CERTIFICATE-----",
		Description: "Multi-line PEM-encoded X.509 certificates",
	},
	{
		Name:        "gcp-service-account",
		Pattern:     regexp.MustCompile(`"type"\s*:\s*"service_account"`),
		Example:     `{"type": "service_account", "project_id": "...", "private_key": "..."}`,
		Description: "GCP service account JSON key marker (\"type\": \"service_account\")",
	},
	{
		Name:        "gcp-oauth-token",
		Pattern:     regexp.MustCompile(`ya29\.[A-Za-z0-9_-]{20,}`),
		Example:     "ya29.XXXXXXXXXXXXXXXXXXXXXXXXXXXX",
		Description: "GCP OAuth2 access / refresh token (starts with ya29., 20+ alphanumeric/_/- chars after)",
	},
	{
		Name:        "slack-token",
		Pattern:     regexp.MustCompile(`xox[bpars]-[A-Za-z0-9-]{20,}`),
		Example:     "xoxb-XXXXXXXXXXXXXXXX-XXXXXXXXXXXXXXXX-XXXXXXXXXXXXXXXXXXXXXXXX",
		Description: "Slack bot/user/app/refresh token (xoxb-, xoxp-, xoxa-, xoxr-, xoxs-, 20+ chars after prefix)",
	},
	{
		Name:        "gitlab-pat",
		Pattern:     regexp.MustCompile(`glpat-[A-Za-z0-9_-]{20,}`),
		Example:     "glpat-XXXXXXXXXXXXXXXXXXXX",
		Description: "GitLab Personal Access Token (starts with glpat-, 20+ chars after prefix)",
	},
	{
		Name:        "openai-api-key",
		Pattern:     regexp.MustCompile(`sk-[A-Za-z0-9]{40,}`),
		Example:     "sk-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
		Description: "OpenAI API key (sk- followed by 40+ alphanumeric chars)",
	},
	{
		Name:        "anthropic-api-key",
		Pattern:     regexp.MustCompile(`sk-ant-[A-Za-z0-9_-]{32,}`),
		Example:     "sk-ant-api03-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
		Description: "Anthropic API key (starts with sk-ant-, 32+ chars after prefix)",
	},
	{
		Name:        "generic-api-key",
		Pattern:     regexp.MustCompile(`(?i)(api[_-]?key)[_-]?[=]?[A-Za-z0-9]{16,}`),
		Example:     "api_key=abcdefghijklmnopqrstuvwx",
		Description: "Generic API key pattern (case-insensitive)",
	},
	{
		Name:        "bearer-token",
		Pattern:     regexp.MustCompile(`(?i)bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+`),
		Example:     "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
		Description: "JWT Bearer token (three base64url segments)",
	},
	{
		Name:        "env-var-value",
		Pattern:     regexp.MustCompile(`\$[A-Z_][A-Z0-9_]{0,30}=([^\s,}]+)`),
		Example:     "$API_KEY=secret123",
		Description: "Environment variable assignment",
	},
}

var EmbedResultHandler func(EmbedOutcome)

var (
	ErrDangerousPattern = errors.New("dangerous regex pattern detected")
)

var SensitiveJSONFieldNames = []string{
	"api_key",
	"apikey",
	"api-key",
	"token",
	"password",
	"passwd",
	"private_key",
	"privatekey",
	"private-key",
	"client_secret",
	"clientsecret",
	"client-secret",
	"secret",
}