"""平台来源错误脱敏原语。"""
from __future__ import annotations

import os
import re
from collections.abc import Iterable

_QUERY_SECRET_RE = re.compile(
    r"(?i)(api[_-]?key|token|secret|password)(=|%3[dD])([^&\s]+)"
)


def safe_error_text(exc: BaseException, secret_env_names: Iterable[str]) -> str:
    """返回可诊断但不包含部署凭据的异常文本。"""

    text = str(exc)
    for name in secret_env_names:
        value = os.environ.get(name, "")
        if value:
            text = text.replace(value, "[REDACTED]")
    return _QUERY_SECRET_RE.sub(r"\1\2[REDACTED]", text)