"use strict";
/**
 * Security Event Logger
 * Issue #96: npm install CLI support
 * SF-SEC-2: Security event logging for CLI commands
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.logSecurityEvent = logSecurityEvent;
exports.maskSensitiveData = maskSensitiveData;
const fs_1 = require("fs");
const path_1 = require("path");
const os_1 = require("os");
/**
 * Get security log file path
 */
function getLogPath() {
    const logDir = process.env.CM_LOG_DIR;
    if (logDir) {
        return (0, path_1.join)(logDir, 'security.log');
    }
    return (0, path_1.join)((0, os_1.homedir)(), '.commandmate-security.log');
}
/**
 * Log a security event
 * Silently fails if file operations fail (non-critical)
 */
function logSecurityEvent(event) {
    try {
        const logPath = getLogPath();
        const maskedDetails = maskSensitiveData(event.details);
        const logLine = `${event.timestamp} [${event.action.toUpperCase()}] ${event.command}: ${maskedDetails || ''}\n`;
        (0, fs_1.appendFileSync)(logPath, logLine, { mode: 0o600 });
    }
    catch {
        // Silently ignore logging failures - they should not affect CLI operation
    }
}
/**
 * Mask sensitive data in log messages
 * SF-SEC-2: Mask authentication tokens in logs
 */
function maskSensitiveData(input) {
    if (!input) {
        return input;
    }
    // Mask any token-like strings (12+ hex/alphanumeric characters after "token:")
    let result = input;
    result = result.replace(/(?:token|Token)[:\s]+([a-zA-Z0-9]{12,})/gi, (_match, token) => {
        return _match.replace(token, '***');
    });
    return result;
}
