refactor(logging): extract maskSensitiveData() to helpers (#398)

Extracted complex inline regex masking logic from loggingDatabaseOperations
to a reusable maskSensitiveData function in helpers.ts.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

Author: google-labs-jules[bot]

src/helpers.ts

@@ -206,4 +206,32 @@ export function uiKindToString(uiKind: vsc.UIKind): 'web' | 'desktop' {
   return uiKind === vsc.UIKind.Web ? 'web' : 'desktop';
 }
 
+// ============================================================================
+// PII/Secret Masking Utilities
+// ============================================================================
+
+const EMAIL_REGEX = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+const PHONE_REGEX = /(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}/g;
+const API_KEY_REGEX = /\b(sk_live_|sk_test_|api_key_|token_|secret_|key_)[a-zA-Z0-9]{10,}\b/gi;
+const HEX_REGEX = /\b[a-fA-F0-9]{32,}\b/g;
+const CC_REGEX = /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g;
+const SSN_REGEX = /\b\d{3}-\d{2}-\d{4}\b/g;
+
+/**
+ * Masks sensitive data like emails, phone numbers, API keys, hex strings,
+ * credit card numbers, and SSNs in a given string.
+ *
+ * @param message - The string to mask
+ * @returns The masked string
+ */
+export function maskSensitiveData(message: string): string {
+  let safeMessage = message;
+  safeMessage = safeMessage.replace(EMAIL_REGEX, '***@***.***');
+  safeMessage = safeMessage.replace(PHONE_REGEX, '***-***-****');
+  safeMessage = safeMessage.replace(API_KEY_REGEX, '$1[REDACTED]');
+  safeMessage = safeMessage.replace(HEX_REGEX, '[REDACTED_HEX]');
+  safeMessage = safeMessage.replace(CC_REGEX, '****-****-****-****');
+  safeMessage = safeMessage.replace(SSN_REGEX, '***-**-****');
+  return safeMessage;
+}
 

src/loggingDatabaseOperations.ts

@@ -6,6 +6,7 @@
  */
 
 import * as vsc from 'vscode';
+import { maskSensitiveData } from './helpers';
 import type {
     DatabaseOperations,
     CellValue,
@@ -78,24 +79,7 @@ export class LoggingDatabaseOperations implements DatabaseOperations {
 
         // Basic PII/Secret masking in the log message itself if it contains SQL values directly
         // This is a heuristic attempt to mask email-like or key-like patterns in raw SQL
-        let safeMessage = message;
-
-        // Mask email addresses
-        safeMessage = safeMessage.replace(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, '***@***.***');
-
-        // Mask phone numbers (various formats: +1-234-567-8901, (234) 567-8901, 234.567.8901, etc.)
-        safeMessage = safeMessage.replace(/(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}/g, '***-***-****');
-
-        // Mask API keys / tokens (long alphanumeric strings that look like secrets, 20+ chars)
-        // Match patterns like: sk_live_xxx, api_key_xxx, or generic hex/base64 tokens
-        safeMessage = safeMessage.replace(/\b(sk_live_|sk_test_|api_key_|token_|secret_|key_)[a-zA-Z0-9]{10,}\b/gi, '$1[REDACTED]');
-        safeMessage = safeMessage.replace(/\b[a-fA-F0-9]{32,}\b/g, '[REDACTED_HEX]');
-
-        // Mask credit card numbers (basic pattern: 16 digits with optional separators)
-        safeMessage = safeMessage.replace(/\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g, '****-****-****-****');
-
-        // Mask SSN patterns (###-##-####)
-        safeMessage = safeMessage.replace(/\b\d{3}-\d{2}-\d{4}\b/g, '***-**-****');
+        const safeMessage = maskSensitiveData(message);
 
         this.outputChannel.appendLine(`${timestamp} ${type} [${this.filename}] ${safeMessage}`);
     }