<?php

declare(strict_types=1);

namespace App\Logging;

/**
 * Stable, non-reversible fingerprint of a sensitive identifier for log
 * correlation (SEC_REVIEW F34).
 *
 * Auth flows previously logged the attempted username, source IP, and OIDC
 * subject in plaintext. Lower-trust SIEM operators reading those records
 * could see passwords typed in the wrong field, raw client addresses, and
 * IdP subject claims — all "accidental disclosure" the review flagged.
 *
 * The fingerprint is the first 12 hex chars of SHA-256 over the value. That
 * is enough entropy to keep collisions vanishingly rare across a single
 * deployment's logs (so triage like "which `username_fp` failed 25 times
 * across these IPs?" still works), while rendering the raw value
 * non-recoverable from a casual look at a log line. It is *not* a
 * cryptographic shield against a determined attacker who already has full
 * log access and is willing to brute-force a small space (e.g. the IPv4
 * universe) — defence against that is out of scope for F34, which is about
 * the casual-viewing surface.
 *
 * Empty input is fingerprinted to a fixed sentinel so an empty username
 * doesn't collide with the SHA-256 of the empty string by accident in a
 * downstream string match.
 */
final class LogIdentifier
{
    private const FINGERPRINT_LENGTH = 12;
    private const EMPTY_SENTINEL = 'empty';

    public static function fingerprint(string $value): string
    {
        if ($value === '') {
            return self::EMPTY_SENTINEL;
        }

        return substr(hash('sha256', $value), 0, self::FINGERPRINT_LENGTH);
    }
}
