// Generated, do not edit. sha256:a1315d2d14082c64a18aae0cc7fe7a0348020a2be792c5953b7fb3ab918f8978
import { readFile, writeFile, mkdir } from 'node:fs/promises';
import { join, dirname } from 'node:path';
import { AUTH_KINDS } from '../shared/config.js';
import { activeDir } from './portfolios.mjs';
import { hasFeature } from './license.mjs';
import { fail } from '../shared/app-error.js';

export function secretsFile() {
  return join(activeDir(), 'secrets.json');
}

export async function readSecretsStore() {
  try { return JSON.parse(await readFile(secretsFile(), 'utf-8')); }
  catch (e) { if (e.code === 'ENOENT') return {}; throw e; }
}
export async function writeSecretsStore(obj) {
  const pad = secretsFile();
  await mkdir(dirname(pad), { recursive: true });
  await writeFile(pad, JSON.stringify(obj, null, 2), { mode: 0o600 });
}

function allowedFields(authKind) {
  const k = AUTH_KINDS[authKind];
  return k ? k.secret_fields : [];
}

export async function getKeys(provider) {
  const all = await readSecretsStore();
  return all[provider] || {};
}

export async function moveProviderKeys(from, to) {
  const all = await readSecretsStore();
  if (!all[from]) return false;
  all[to] = { ...all[from], ...(all[to] || {}) };
  delete all[from];
  await writeSecretsStore(all);
  return true;
}

export async function keyStatus(provider, authKind) {
  const fields = allowedFields(authKind);
  const stored = await getKeys(provider);
  const configured = {};
  for (const f of fields) configured[f] = String(stored[f] || '').length > 0;
  return { provider, fields, configured, complete: fields.length > 0 && fields.every(f => configured[f]) };
}

export async function setKeys(provider, authKind, incoming) {
  if (!hasFeature('providerKeys')) {
    fail('integrations.keysPaid', null,
      'Your own provider keys belong to the paid version; the standard sources keep working.');
  }
  const fields = allowedFields(authKind);
  if (!fields.length) throw new Error(`Provider '${provider}' (auth '${authKind}') has no key fields.`);
  const all = await readSecretsStore();
  const cur = all[provider] || {};
  for (const f of fields) {
    const v = incoming && typeof incoming[f] === 'string' ? incoming[f].trim() : '';
    if (v.length) cur[f] = v;
  }
  all[provider] = cur;
  await writeSecretsStore(all);
  return keyStatus(provider, authKind);
}