Quan sát hệ thống

/** Secrets are dropped; device values are hashed; API keys are cut to the prefix the portal shows. */
const SECRET_FIELDS = new Set(['authorization', 'api_key', 'play_auth_token', 'grant_ticket', 'manifest_url']);
const HASHED_FIELDS = new Set(['union_info', 'drm_kek']);

/** `wnd_live_ab12cd…` → `wnd_live_ab12cd`. Enough for support, useless to an attacker. */
export function keyPrefix(key: string): string {
  return key.slice(0, 15);
}

/** Copy with secrets removed. Run everything you log, trace or send to a crash reporter through it. */
export function redact(value: unknown): unknown {
  if (Array.isArray(value)) return value.map(redact);
  if (typeof value === 'string') return value.replace(/wnd_live_[A-Za-z0-9_-]{6,}/g, (k) => `${keyPrefix(k)}…`);
  if (!value || typeof value !== 'object') return value;
  const out: Record<string, unknown> = {};
  for (const [k, v] of Object.entries(value)) {
    const lk = k.toLowerCase();
    if (SECRET_FIELDS.has(lk)) out[k] = '[redacted]';
    else if (HASHED_FIELDS.has(lk) && typeof v === 'string') out[k] = `sha256:${createHash('sha256').update(v).digest('hex').slice(0, 12)}`;
    else out[k] = redact(v);
  }
  return out;
}