"""客服会话落库前的敏感凭据最小化处理。"""

import re

# 替换顺序从带业务语义的凭据开始，避免通用数字规则先破坏上下文。
_SENSITIVE_PATTERNS: tuple[tuple[re.Pattern[str], str], ...] = (
    (re.compile(r"(?i)((?:登录|交易)?密码)\s*(?:[:：=]|是)\s*[^\s，。；,;]{1,64}"), r"\1[已隐藏]"),
    (re.compile(r"(?i)((?:登录|交易)?密码)\s*\d{4,32}"), r"\1[已隐藏]"),
    (re.compile(r"(?i)(验证码|短信码|校验码)\s*(?:[:：=]|是)?\s*\d{4,8}"), r"\1[已隐藏]"),
    (re.compile(r"(?<!\d)\d{17}[\dXx](?!\d)"), "[证件号已隐藏]"),
    (re.compile(r"(?<!\d)(?:\d[ -]?){15,18}\d(?!\d)"), "[银行卡号已隐藏]"),
    (re.compile(r"(?<!\d)1[3-9]\d{9}(?!\d)"), "[手机号已隐藏]"),
)

def sanitize_customer_service_message(message: str) -> str:
    """保留风险关键词，移除不应进入会话、Outbox 或后续 Redis 的凭据值。"""
    sanitized = message
    for pattern, replacement in _SENSITIVE_PATTERNS:
        sanitized = pattern.sub(replacement, sanitized)
    return sanitized