package controller

import (
	"context"

	corev1 "k8s.io/api/core/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"sigs.k8s.io/controller-runtime/pkg/client"

	terdutv1alpha1 "git.ryuvia.com/niklas/terdut-operator/api/v1alpha1"
)

// credentialsSecretDataKey is the fixed data key every generated
// credentials Secret this controller writes uses — "whatever a human chose"
// only applied to the bring-your-own input an earlier design draft had and
// removed (DESIGN.md §6); every Secret any controller in this repo
// generates itself uses this one key.
const credentialsSecretDataKey = "token"

// writeOperatorSecret creates or replaces a Secret in namespace (always the
// operator's own, DESIGN.md §6) holding one raw value under
// credentialsSecretDataKey. Shared by every controller that generates a
// credential there -- TerdutServer's instance-scoped key and the bootstrap
// admin-key checkpoint, TerdutTeam's team-scoped key.
func writeOperatorSecret(ctx context.Context, c client.Client, namespace, name, rawValue string) error {
	secret := &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
		Data:       map[string][]byte{credentialsSecretDataKey: []byte(rawValue)},
	}
	if err := c.Create(ctx, secret); err != nil {
		if apierrors.IsAlreadyExists(err) {
			return c.Update(ctx, secret)
		}
		return err
	}
	return nil
}

// readOperatorSecret reads one generated credential back, by the
// SecretKeyRef a controller's own status stores (always resolved in the
// operator's own namespace, never the referencing CR's -- DESIGN.md §6).
func readOperatorSecret(ctx context.Context, c client.Client, namespace string, ref *terdutv1alpha1.SecretKeyRef) (string, error) {
	var secret corev1.Secret
	if err := c.Get(ctx, client.ObjectKey{Namespace: namespace, Name: ref.Name}, &secret); err != nil {
		return "", err
	}
	return string(secret.Data[ref.Key]), nil
}