<?php

namespace App\Support;

class CallbackPayload
{
    /**
     * Remove credentials and signatures before callback data is persisted.
     * Keep the field names so an operator can still diagnose configuration.
     */
    public static function sanitize(array $payload): array
    {
        foreach ($payload as $key => $value) {
            if (preg_match('/(?:secret|password|token|api[_-]?key|signature|verifier|secure[_-]?hash|^sig$)/i', (string) $key)) {
                $payload[$key] = '[REDACTED]';
                continue;
            }

            if (is_array($value)) {
                $payload[$key] = self::sanitize($value);
            }
        }

        return $payload;
    }
}
