"""Small shared helpers (no Django imports — safe to use from model code)."""


def mask_identifier_value(value: str) -> str:
    """Mask a PHI identifier value for __str__/log rendering.

    Keeps only the last 4 characters so rows stay correlatable without
    exposing MBI/phone/email/address in admin list views or log output.
    """
    if not value:
        return "(empty)"
    if len(value) <= 4:
        return "****"
    return f"...{value[-4:]}"