package server

import "github.com/getsentry/sentry-go"

// sentryRedactedQuery stands in for the query string on every event
// shipped to Sentry.
const sentryRedactedQuery = "(redacted)"

// scrubSentryRequest drops the query string from an event's request
// context before it leaves the process.
//
// sentryhttp attaches the whole *http.Request to the scope, and
// sentry.NewRequest copies r.URL.RawQuery verbatim into
// Request.QueryString. That path is independent of the access log: it
// is populated from the request even though the log line for the same
// request records only the route pattern or a redacted query. Any
// error or panic captured while serving a request would therefore ship
// the query string to a third-party service, and a query string is
// client-chosen text that a mistyped or hand-built request can put a
// credential into.
//
// The query is not debugging signal here. One route in the service
// reads a query parameter at all — `page`, on the authenticated
// pagination links in internal/handlers/source_management.go — and
// Request.URL still carries scheme, host and path, which is what
// identifies the failing route.
func scrubSentryRequest(
	event *sentry.Event,
	_ *sentry.EventHint,
) *sentry.Event {
	if event == nil || event.Request == nil {
		return event
	}

	if event.Request.QueryString != "" {
		event.Request.QueryString = sentryRedactedQuery
	}

	return event
}