const winston = require("winston");

// Structured JSON logging so records can be shipped to a log aggregator.
// Never log secrets, raw passwords, tokens, or full payment identifiers —
// see redact() usage in controllers.
const logger = winston.createLogger({
  level: process.env.LOG_LEVEL || "info",
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.errors({ stack: true }),
    winston.format.json()
  ),
  defaultMeta: { service: "aynwerd-api" },
  transports: [new winston.transports.Console()],
});

/**
 * Redact all but the last `keep` characters of a sensitive string, e.g.
 * for logging a payment reference without exposing it in full.
 */
function redact(value, keep = 4) {
  if (!value) return value;
  const str = String(value);
  if (str.length <= keep) return "*".repeat(str.length);
  return `${"*".repeat(str.length - keep)}${str.slice(-keep)}`;
}

module.exports = logger;
module.exports.redact = redact;