/**
 * System vault-password command
 */

import { getVaultPassword } from '../../secrets/vault';
import type { CommandResult } from '../types';

/**
 * Handle system vault-password command
 *
 * Usage: celilo system vault-password
 *
 * Returns the Ansible Vault password derived from the master key.
 * Used for decrypting ansible/inventory/secrets.yml files.
 *
 * @returns Command result with vault password
 */
export async function handleSystemVaultPassword(): Promise<CommandResult> {
  try {
    const vaultPassword = await getVaultPassword();

    return {
      success: true,
      message: vaultPassword,
      data: { vaultPassword },
    };
  } catch (error) {
    return {
      success: false,
      error: 'Failed to get vault password',
      details: error,
    };
  }
}