/**
 * Module secret get command
 * Retrieves and decrypts a module-level secret
 */

import { and, eq } from 'drizzle-orm';
import { getDb } from '../../db/client';
import { secrets } from '../../db/schema';
import { decryptSecret } from '../../secrets/encryption';
import { getOrCreateMasterKey } from '../../secrets/master-key';
import { getArg } from '../parser';
import type { CommandResult } from '../types';

/**
 * Handle module secret get command
 *
 * Usage: celilo module secret get <module-id> <key>
 *
 * @param args - Command arguments
 * @returns Command result with decrypted secret value
 */
export async function handleModuleSecretGet(args: string[]): Promise<CommandResult> {
  const moduleId = getArg(args, 0);
  const key = getArg(args, 1);

  if (!moduleId || !key) {
    return {
      success: false,
      error: 'Usage: celilo module secret get <module-id> <key>',
    };
  }

  const db = getDb();
  const secret = db
    .select()
    .from(secrets)
    .where(and(eq(secrets.moduleId, moduleId), eq(secrets.name, key)))
    .get();

  if (!secret) {
    return {
      success: false,
      error: `Secret not found: ${moduleId}/${key}`,
    };
  }

  const masterKey = await getOrCreateMasterKey();
  const decrypted = decryptSecret(
    { encryptedValue: secret.encryptedValue, iv: secret.iv, authTag: secret.authTag },
    masterKey,
  );

  return {
    success: true,
    message: decrypted,
    rawOutput: true,
    data: { moduleId, key, value: decrypted },
  };
}