From c246c4a719e6e6a47679dfc30d24a69fc06f5abc Mon Sep 17 00:00:00 2001
From: mitchellecm7 <obidikechukwuagozie1@gmail.com>
Date: Sun, 19 Jul 2026 16:06:49 -0700
Subject: [PATCH] feat: add maskFields helper for redacting sensitive fields in
 logs - Closes #569

---
 src/utils/log-field-sanitizer.utils.ts | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/src/utils/log-field-sanitizer.utils.ts b/src/utils/log-field-sanitizer.utils.ts
index f761579..f095407 100644
--- a/src/utils/log-field-sanitizer.utils.ts
+++ b/src/utils/log-field-sanitizer.utils.ts
@@ -101,3 +101,22 @@ export function sanitizeLogObject(obj: unknown): unknown {
 
    return obj;
 }
+
+/**
+ * Masks sensitive fields in an object by replacing their values with [REDACTED].
+ * Works recursively for nested objects. Does not mutate the original object.
+ */
+export function maskFields(obj: Record<string, unknown>, fields: string[]): Record<string, unknown> {
+  const fieldSet = new Set(fields);
+  const result: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (fieldSet.has(key)) {
+      result[key] = '[REDACTED]';
+    } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      result[key] = maskFields(value as Record<string, unknown>, fields);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}