refactor(core): enhance SDK structure and documentation

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

src/Http/Middleware/LoggingMiddleware.php

@@ -0,0 +1,79 @@
+<?php
+/*
+// MODULE_CONTRACT: Provides a Saloon middleware for logging API requests and responses, with sensitive data masking.
+// RESPONSIBILITY: To intercept and log outgoing API requests and incoming API responses, providing visibility into the communication flow for debugging and monitoring purposes, while also sanitizing sensitive information from logs to maintain security and compliance.
+// INPUTS: Psr\Log\LoggerInterface for logging; Saloon `Request` and `Response` objects.
+// OUTPUTS: Logs detailed request and response information (with masked sensitive data) to the configured logger.
+// LINKS: Core/AlfaBankConnector.php, Sbp/SbpConnector.php, README.md#logging
+*/
+
+namespace Apoloz\AlfaBank\Http\Middleware;
+
+// <SECTION name="module_imports" intent="Import necessary classes for logging and Saloon HTTP components.">
+// <BELIEF_STATE "These imports are fundamental for the logging middleware. `LoggerInterface` from PSR-3 defines the contract for logging, allowing flexibility in the choice of logging implementation. `Request` and `Response` from Saloon are the HTTP objects that this middleware will observe and log, providing insights into the API communication lifecycle.">
+use Psr\Log\LoggerInterface;
+use Saloon\Http\PendingRequest;
+use Saloon\Http\Response;
+// </SECTION>
+
+// <SECTION name="class_definition" intent="Define the API request and response logging middleware.">
+// <BELIEF_STATE "The `LoggingMiddleware` plays a crucial role in the observability of the SDK. By implementing `onRequest` and `onResponse` methods, it captures detailed information about HTTP interactions, including headers and body. Crucially, it incorporates sensitive data masking to prevent credentials and personal information from being exposed in logs, balancing transparency with security and compliance requirements.">
+class LoggingMiddleware
+{
+    // <SECTION name="constructor_definition" intent="Initialize the middleware with a logger instance.">
+    // <BELIEF_STATE "The constructor injects a `LoggerInterface` instance, making the logging functionality easily testable and configurable. This adheres to dependency inversion principles, allowing the middleware to log messages without being tightly coupled to a specific logging implementation.">
+    public function __construct(protected LoggerInterface $logger) {}
+    // </SECTION>
+
+    // <SECTION name="on_request_method" intent="Log outgoing API requests.">
+    // <BELIEF_STATE "The `onRequest` method intercepts each outgoing HTTP request. It logs the request method and endpoint, along with masked headers and body content. Masking of sensitive information like authorization headers and payment data is performed by `maskHeaders` and `maskBody` methods, ensuring that debugging logs do not compromise security.">
+    public function onRequest(PendingRequest $request): void
+    {
+        $this->logger->info("AlfaBank Request: {$request->getMethod()->value} {$request->getRequest()->resolveEndpoint()}", [
+            'headers' => $this->maskHeaders($request->headers()->all()),
+            'body' => $this->maskBody($request->body()?->all()),
+        ]);
+    }
+    // </SECTION>
+
+    // <SECTION name="on_response_method" intent="Log incoming API responses.">
+    // <BELIEF_STATE "The `onResponse` method intercepts each incoming HTTP response. It logs the response status and the masked response body. This provides valuable information for debugging API integrations and understanding the server's responses, all while maintaining the privacy of potentially sensitive data within the response payload.">
+    public function onResponse(Response $response): void
+    {
+        $this->logger->info("AlfaBank Response: {$response->status()}", [
+            'body' => $this->maskBody($response->json()),
+        ]);
+    }
+    // </SECTION>
+
+    // <SECTION name="mask_headers_method" intent="Mask sensitive information in HTTP headers.">
+    // <BELIEF_STATE "This protected helper method iterates through the request headers and replaces the `Authorization` header's value with a generic placeholder. This prevents sensitive tokens from being inadvertently exposed in logs, which is a crucial security measure.">
+    protected function maskHeaders(array $headers): array
+    {
+        if (isset($headers['Authorization'])) {
+            $headers['Authorization'] = 'Bearer *****';
+        }
+        return $headers;
+    }
+    // </SECTION>
+
+    // <SECTION name="mask_body_method" intent="Mask sensitive information in request/response bodies.">
+    // <BELIEF_STATE "This protected recursive helper method inspects the request or response body for predefined sensitive keys (e.g., `pan`, `client_secret`). If a sensitive key is found, its value is replaced with a mask. The method recursively processes nested arrays, ensuring that sensitive data is masked even within complex JSON structures, thereby enhancing log security.">
+    protected function maskBody(mixed $body): mixed
+    {
+        if (!is_array($body)) return $body;
+
+        $sensitiveKeys = ['pan', 'cvc', 'digestSignatures', 'client_secret', 'refresh_token', 'access_token'];
+
+        foreach ($body as $key => $value) {
+            if (in_array($key, $sensitiveKeys, true)) {
+                $body[$key] = '*****';
+            } elseif (is_array($value)) {
+                $body[$key] = $this->maskBody($value);
+            }
+        }
+        return $body;
+    }
+    // </SECTION>
+}
+// </SECTION>