/**
 * System secret set command
 * Sets encrypted system-level secrets
 */

import { getDb } from '../../db/client';
import { getArg, validateRequiredArgs } from '../parser';
import type { CommandResult } from '../types';

/**
 * Valid system secret keys
 * These are system-level secrets that can be stored encrypted
 */
const VALID_SYSTEM_SECRET_KEYS = [
  'proxmox.root_password', // Container root password
  'proxmox.api_token_id', // Proxmox API token ID (e.g., "root@pam!terraform")
  'proxmox.api_token_secret', // Proxmox API token secret
] as const;

type SystemSecretKey = (typeof VALID_SYSTEM_SECRET_KEYS)[number];

/**
 * Handle system secret set command
 *
 * Usage: celilo system secret set <key> <value>
 *
 * @param args - Command arguments
 * @returns Command result
 */
export async function handleSystemSecretSet(args: string[]): Promise<CommandResult> {
  // Validate arguments
  const error = validateRequiredArgs(args, 2);
  if (error) {
    return {
      success: false,
      error: `${error}\n\nUsage: celilo system secret set <key> <value>\n\nValid keys: ${VALID_SYSTEM_SECRET_KEYS.join(', ')}`,
    };
  }

  const key = getArg(args, 0);
  const value = getArg(args, 1);

  if (!key || !value) {
    return {
      success: false,
      error: 'Key and value are required',
    };
  }

  // Validate key
  if (!VALID_SYSTEM_SECRET_KEYS.includes(key as SystemSecretKey)) {
    return {
      success: false,
      error: `Invalid system secret key: ${key}\n\nValid keys: ${VALID_SYSTEM_SECRET_KEYS.join(', ')}`,
    };
  }

  // Store system secret using utility function
  const { storeSystemSecret } = await import('../../secrets/storage');

  try {
    const db = getDb();
    await storeSystemSecret(key, value, db);

    return {
      success: true,
      message: `Set system secret: ${key}`,
    };
  } catch (err) {
    return {
      success: false,
      error: 'Failed to store system secret',
      details: err,
    };
  }
}