edr-platform/apps/edr-freight-api/src/modules/auth/mask-target.util.ts

import { OtpTarget } from "../otp/otp.service";

function maskEmail(email: string): string {
  const [local, domain] = email.split("@");
  const head = local.slice(0, 1);
  return `${head}${"•".repeat(Math.max(local.length - 1, 1))}@${domain}`;
}

function maskPhone(phone: string): string {
  return `${phone.slice(0, 4)}${"•".repeat(Math.max(phone.length - 8, 1))}${phone.slice(-4)}`;
}

/**
 * Mask an OTP target for echoing back to the caller: `+251911234567` ->
 * `+251•••••4567`; `ab@x.com` -> `a•@x.com`. Never return an unmasked target to
 * a caller who has not yet proven possession of the channel.
 *
 * A dual-channel target masks both and joins them, so the UI can say exactly
 * where the code went ("a•@x.com and +251•••••4567") — a user who only checks
 * one of the two otherwise assumes the other never received anything.
 */
export function maskOtpTarget(target: OtpTarget): string {
  const parts: string[] = [];
  if (target.email) parts.push(maskEmail(target.email));
  if (target.phone) parts.push(maskPhone(target.phone));
  return parts.join(" and ");
}