from fastapi import APIRouter, Depends, HTTPException
from pydantic import BaseModel

from . import vault
from .auth import require_token
from .db import get_db

# Admin-gated. The dash POSTs credentials in; values are encrypted at rest and NEVER returned.
router = APIRouter(prefix="/settings", tags=["settings"])

# The credentials the dash knows how to collect (name → human label).
KNOWN = {
    "woo_base_url": "WooCommerce store URL (https://…)",
    "woo_consumer_key": "WooCommerce REST consumer key (ck_…)",
    "woo_consumer_secret": "WooCommerce REST consumer secret (cs_…)",
    "discogs_consumer_key": "Discogs OAuth consumer key",
    "discogs_consumer_secret": "Discogs OAuth consumer secret",
    "discogs_token": "Discogs personal access token",
    "cloudflare_api_token": "Cloudflare API token",
    "dealgod_api_key": "DealGod API key (X-Api-Key)",
}


class SecretIn(BaseModel):
    name: str
    value: str


@router.get("/secrets")
async def list_secrets(ident=Depends(require_token), db=Depends(get_db)):
    have = {s["name"]: s["updated_at"] for s in await vault.list_secret_names(db)}
    return {"ok": True, "fields": [
        {"name": n, "label": label, "set": n in have, "updated_at": have.get(n)}
        for n, label in KNOWN.items()
    ]}


@router.post("/secrets")
async def save_secret(body: SecretIn, ident=Depends(require_token), db=Depends(get_db)):
    if body.name not in KNOWN:
        raise HTTPException(400, "unknown secret name")
    if not body.value.strip():
        raise HTTPException(400, "empty value")
    try:
        await vault.set_secret(db, body.name, body.value.strip())
    except vault.SecretsUnconfigured as e:
        raise HTTPException(503, str(e))
    return {"ok": True, "name": body.name, "set": True}