package engine

import "time"

// Finding represents a detected API key from the scanning pipeline.
// KeyValue holds the plaintext key -- the storage layer encrypts it before persisting.
type Finding struct {
	ProviderName string
	KeyValue     string // full plaintext key
	KeyMasked    string // first8...last4
	Confidence   string // "high", "medium", "low"
	Source       string // file path or description
	SourceType   string // "file", "dir", "git", "stdin", "url"
	LineNumber   int
	Offset       int64
	DetectedAt   time.Time
}

// MaskKey returns a masked representation: first 8 chars + "..." + last 4 chars.
// Returns "****" if the key is shorter than 12 characters.
func MaskKey(key string) string {
	if len(key) < 12 {
		return "****"
	}
	return key[:8] + "..." + key[len(key)-4:]
}