import os

from werkzeug.serving import WSGIRequestHandler

from backend.app import create_app

app = create_app()


class RedactingRequestHandler(WSGIRequestHandler):
    """Werkzeug access log handler that never writes query strings to the log.

    Credentials must never be sent in URLs, but as defense in depth this also
    prevents any accidental query value (tokens, emails, passwords) from being
    recorded in the server log.
    """

    def log_request(self, code="-", size="-"):
        try:
            target = self.path or self.requestline.split(" ")[1]
        except Exception:
            target = self.requestline
        if "?" in target:
            target = target.split("?", 1)[0] + "?[redacted]"
        try:
            msg = f"{self.command} {target} {self.request_version}"
        except Exception:
            msg = self.requestline
        code = str(code)
        level = "warning" if code[:1] in ("4", "5") else "info"
        self.log(level, '"%s" %s %s', msg, code, size)


if __name__ == "__main__":
    host = os.environ.get("FLASK_HOST", "127.0.0.1")
    port = int(os.environ.get("FLASK_PORT", "8085"))
    debug = os.environ.get("FLASK_DEBUG", "false").lower() == "true"
    app.run(host=host, port=port, debug=debug, request_handler=RedactingRequestHandler)