feat(audit): sanitize stored upstream responses

backend/internal/audit/sanitize.go

@@ -0,0 +1,48 @@
+package audit
+
+import (
+	"encoding/json"
+	"strings"
+)
+
+func SanitizeResponse(raw []byte, maskedCard string) []byte {
+	if len(raw) == 0 {
+		return nil
+	}
+
+	var value any
+	if err := json.Unmarshal(raw, &value); err != nil {
+		return nil
+	}
+
+	if maskedCard == "" {
+		maskedCard = "[redacted]"
+	}
+
+	redactCardFields(value, maskedCard)
+
+	sanitized, err := json.Marshal(value)
+	if err != nil {
+		return nil
+	}
+
+	return sanitized
+}
+
+func redactCardFields(value any, maskedCard string) {
+	switch current := value.(type) {
+	case map[string]any:
+		for key, child := range current {
+			if strings.EqualFold(key, "card") {
+				current[key] = maskedCard
+				continue
+			}
+
+			redactCardFields(child, maskedCard)
+		}
+	case []any:
+		for _, child := range current {
+			redactCardFields(child, maskedCard)
+		}
+	}
+}