/**
 * System secret get command
 * Retrieves and decrypts system-level secrets
 */

import { eq } from 'drizzle-orm';
import { getDb } from '../../db/client';
import { systemSecrets } from '../../db/schema';
import { decryptSecret } from '../../secrets/encryption';
import { getOrCreateMasterKey } from '../../secrets/master-key';
import { getArg } from '../parser';
import type { CommandResult } from '../types';

/**
 * Handle system secret get command
 *
 * Usage: celilo system secret get [key]
 * - With key: returns decrypted value for specific key
 * - Without key: lists all system secret keys (not values)
 *
 * @param args - Command arguments
 * @returns Command result
 */
export async function handleSystemSecretGet(args: string[]): Promise<CommandResult> {
  const key = getArg(args, 0);
  const db = getDb();

  // If no key provided, list all system secret keys
  if (!key) {
    const allSecrets = db.select().from(systemSecrets).all();

    if (allSecrets.length === 0) {
      return {
        success: true,
        message: 'No system secrets configured',
      };
    }

    const lines = ['System secrets:'];
    for (const secret of allSecrets) {
      const desc = secret.description ? ` (${secret.description})` : '';
      lines.push(`  ${secret.key}${desc}`);
    }

    return {
      success: true,
      message: lines.join('\n'),
      data: allSecrets.map((s) => ({ key: s.key, description: s.description })),
    };
  }

  // Get specific secret
  const secret = db.select().from(systemSecrets).where(eq(systemSecrets.key, key)).get();

  if (!secret) {
    return {
      success: false,
      error: `System secret not found: ${key}`,
    };
  }

  // Get master key
  let masterKey: Buffer;
  try {
    masterKey = await getOrCreateMasterKey();
  } catch (err) {
    return {
      success: false,
      error: 'Failed to access master key',
      details: err,
    };
  }

  // Decrypt secret
  let decrypted: string;
  try {
    decrypted = decryptSecret(
      {
        encryptedValue: secret.encryptedValue,
        iv: secret.iv,
        authTag: secret.authTag,
      },
      masterKey,
    );
  } catch (err) {
    return {
      success: false,
      error: 'Failed to decrypt secret',
      details: err,
    };
  }

  return {
    success: true,
    message: decrypted,
    data: { key: secret.key, value: decrypted },
  };
}