/**
 * @file Machine-level lane secrets: the database and Redis connection settings
 * shared by every lane on this host. Deliberately NOT part of a repository's
 * `.ccam/profile/` — a profile is committed and read by anyone who clones the
 * repo, and a database password does not belong there. Lives instead at
 * `~/.ccam/secrets.env`, parsed with the same literal `KEY=VALUE` reader
 * `lane-profile.js` uses for `profile.env` (config is parsed, never sourced).
 *
 * Never returned by any route: `GET /runtime` may report which keys are
 * present, never their values.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const fs = require("node:fs");
const os = require("node:os");
const path = require("node:path");

const { parseEnvFile } = require("./lane-profile");

const SECRETS_PATH =
  process.env.CCAM_SECRETS_PATH || path.join(os.homedir(), ".ccam", "secrets.env");

/** Every declaration a lane's database/Redis facts can rely on when the file
 *  is absent or unreadable — a local default stack, not a guess. */
const DEFAULTS = Object.freeze({
  PG_HOST: "127.0.0.1",
  PG_PORT: "5432",
  PG_USER: "postgres",
  PG_PASS: "postgres",
  REDIS_HOST: "127.0.0.1",
  REDIS_PORT: "6379",
});

let warnedMissing = false;
let warnedPerms = false;

/**
 * Read `~/.ccam/secrets.env`, merged over DEFAULTS.
 *
 * Never throws: a missing file warns once and falls back to DEFAULTS (a lane
 * with no secrets file still gets a usable local Postgres/Redis target), and a
 * file readable by group or world is refused outright rather than trusted —
 * loading it would make CCAM the thing that taught a shared machine's other
 * users the database password.
 *
 * @returns {Record<string,string>}
 */
function readSecrets() {
  if (!fs.existsSync(SECRETS_PATH)) {
    if (!warnedMissing) {
      warnedMissing = true;
      console.warn(
        `[secrets] no ${SECRETS_PATH} — per-lane databases use built-in defaults ` +
          `(${DEFAULTS.PG_HOST}:${DEFAULTS.PG_PORT})`
      );
    }
    return { ...DEFAULTS };
  }

  const mode = fs.statSync(SECRETS_PATH).mode & 0o777;
  if (mode & 0o077) {
    if (!warnedPerms) {
      warnedPerms = true;
      console.warn(
        `[secrets] ${SECRETS_PATH} is readable by group or world (mode ${mode.toString(8)}) ` +
          `— refusing to load it. Fix with: chmod 600 ${SECRETS_PATH}`
      );
    }
    return { ...DEFAULTS };
  }

  try {
    return { ...DEFAULTS, ...parseEnvFile(fs.readFileSync(SECRETS_PATH, "utf8")) };
  } catch {
    return { ...DEFAULTS }; // unreadable file is the same as no file
  }
}

module.exports = { SECRETS_PATH, DEFAULTS, readSecrets };