from typing import Any

from app.core.config import get_settings


MASKED_VALUE = "[MASKED]"
SENSITIVE_RESPONSE_KEYS = frozenset(
    {
        "account_number",
        "api_key",
        "bank_account",
        "card_no",
        "direct_llm_api_key",
        "email",
        "feishu_app_secret",
        "feishu_verification_token",
        "hermes_api_key",
        "id_card",
        "mobile",
        "openclaw_gateway_token",
        "password",
        "payment_account",
        "phone",
        "secret",
        "tenant_access_token",
        "token",
    }
)


def mask_configured(value: Any) -> Any:
    """Mask sensitive response fields when response masking is enabled."""

    settings = get_settings()
    if not settings.mask_sensitive_responses:
        return value
    return mask_sensitive(value)


def mask_sensitive(value: Any) -> Any:
    if isinstance(value, dict):
        masked: dict[str, Any] = {}
        for key, item in value.items():
            key_text = str(key)
            if key_text.lower() in SENSITIVE_RESPONSE_KEYS:
                masked[key_text] = MASKED_VALUE
            else:
                masked[key_text] = mask_sensitive(item)
        return masked
    if isinstance(value, list):
        return [mask_sensitive(item) for item in value]
    if isinstance(value, tuple):
        return [mask_sensitive(item) for item in value]
    return value