"""Settings + secrets: a key/value store surfaced to the UI and injected as env
vars into operator subprocesses. Secret values are redacted from job logs."""

# setting key -> environment variable name handed to operator subprocesses
ENV_MAP = {
    "fal_key": "FAL_KEY",
    "tripo_key": "TRIPO_KEY",
    "meshy_key": "MESHY_KEY",
    "replicate_token": "REPLICATE_API_TOKEN",
    "openrouter_key": "OPENROUTER_API_KEY",
    "hf_token": "HF_TOKEN",
    "models_dir": "MODELBEAST_MODELS_DIR",
    "archive_host": "MODELBEAST_ARCHIVE_HOST",
    "archive_path": "MODELBEAST_ARCHIVE_PATH",
}

# keys whose values are secret: rendered as password fields, redacted from logs
SECRET_KEYS = {"fal_key", "tripo_key", "meshy_key", "replicate_token", "openrouter_key", "hf_token"}

DEFAULTS = {
    "archive_host": "m3ultra@100.69.21.128",
    "archive_path": "~/modelbeast-archive",
}


def get_all(con) -> dict:
    rows = con.execute("SELECT key, value FROM settings").fetchall()
    out = dict(DEFAULTS)
    for r in rows:
        out[r["key"]] = r["value"]
    return out


def set_many(con, updates: dict) -> None:
    for key, value in updates.items():
        con.execute(
            "INSERT INTO settings (key, value) VALUES (?, ?) "
            "ON CONFLICT(key) DO UPDATE SET value = excluded.value",
            (key, "" if value is None else str(value)),
        )
    con.commit()


def public_view(settings: dict) -> dict:
    """Mask secret values so the UI can show 'set / unset' without leaking them."""
    out = {}
    for key, value in settings.items():
        if key in SECRET_KEYS:
            out[key] = "••••••••" if value else ""
        else:
            out[key] = value
    return out


def env_from_settings(settings: dict) -> dict:
    env = {}
    for key, env_name in ENV_MAP.items():
        value = settings.get(key)
        if value:
            env[env_name] = value
    # HF libraries read several token names
    if settings.get("hf_token"):
        env["HUGGING_FACE_HUB_TOKEN"] = settings["hf_token"]
    return env


def secret_values(settings: dict) -> list[str]:
    return [settings[k] for k in SECRET_KEYS if settings.get(k)]


def redact(text: str, secrets: list[str]) -> str:
    if not text:
        return text
    for secret in secrets:
        if secret and len(secret) >= 6:
            text = text.replace(secret, "••••REDACTED••••")
    return text