/** 敏感字段递归脱敏：命中的字段值替换为 ***（供请求体日志与审计参数复用）。 */
const SENSITIVE_KEYS = new Set([
  'password',
  'passwordhash',
  'oldpassword',
  'newpassword',
  'confirmpassword',
  'refreshtoken',
  'token',
  'secret',
  'authorization',
]);

export function maskSensitive(value: unknown): unknown {
  if (value === null || value === undefined) return value;
  if (Array.isArray(value)) return value.map(maskSensitive);
  if (typeof value === 'object') {
    const out: Record<string, unknown> = {};
    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
      out[k] = SENSITIVE_KEYS.has(k.toLowerCase()) ? '***' : maskSensitive(v);
    }
    return out;
  }
  return value;
}