using MeterVault.Infrastructure.Security;

namespace MeterVault.Infrastructure.Ingestion;

/// <summary>
/// Resolves one connector secret from the two storage forms an endpoint config may use: a value
/// typed into the admin UI and encrypted at rest, or the name of an environment variable resolved
/// at runtime. Neither form keeps plaintext in the database (SDD §6.4).
/// </summary>
internal static class EndpointSecret
{
    /// <summary>
    /// Encrypted wins over the env-var reference when both are present. They are mutually exclusive
    /// in the UI, so both being set means a connector was switched from one mode to the other and
    /// the write did not clear the old field; honouring the encrypted value keeps the connector on
    /// whichever secret was most recently entered.
    /// </summary>
    public static string? Resolve(string? encrypted, string? envVarName, SecretProtector? protector)
    {
        if (!string.IsNullOrWhiteSpace(encrypted)
            && protector is not null
            && protector.TryUnprotect(encrypted, out var plaintext))
        {
            return plaintext;
        }

        return string.IsNullOrWhiteSpace(envVarName) ? null : Environment.GetEnvironmentVariable(envVarName);
    }
}