package localtools

import (
	"context"
	"fmt"
	"os/exec"
	"strings"
)

// OpSecretStore implements adminbootstrap.SecretStore against the local
// `op` (1Password) CLI. Run is injectable for tests; nil defaults to
// actually invoking `op`.
//
// The token value is passed via the child process's stdin, never as a
// literal argv element — matching the estate's own secret-handling rule
// (a value in argv lands in process listings and any transcript of the
// command). `credential[password]=-` is `op item create`'s documented way
// to read one field's value from stdin instead of the command line.
type OpSecretStore struct {
	Vault string
	Run   func(ctx context.Context, stdin string, args ...string) error
}

func (s OpSecretStore) Store(ctx context.Context, name, value string) (string, error) {
	run := s.Run
	if run == nil {
		run = runOp
	}
	args := []string{
		"item", "create",
		"--category=login",
		"--vault=" + s.Vault,
		"--title=" + name,
		"credential[password]=-",
	}
	if err := run(ctx, value, args...); err != nil {
		return "", fmt.Errorf("op item create: %w", err)
	}
	return fmt.Sprintf("op://%s/%s/credential", s.Vault, name), nil
}

func runOp(ctx context.Context, stdin string, args ...string) error {
	cmd := exec.CommandContext(ctx, "op", args...)
	cmd.Stdin = strings.NewReader(stdin)
	out, err := cmd.CombinedOutput()
	if err != nil {
		return fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
	}
	return nil
}