/**
 * Compose `TF_VAR_*` environment variables from a module's bound
 * container-service credentials. Shared between `module-deploy`
 * (which executes terraform during deployment) and `system audit`'s
 * terraform-plan check (which needs the same credentials to run a
 * non-mutating `terraform plan`).
 *
 * Modules bound to a machine instead of a container service get an
 * empty record — there are no provider credentials to inject.
 */

import { eq } from 'drizzle-orm';
import type { DbClient } from '../db/client';
import { moduleInfrastructure } from '../db/schema';
import { getContainerService, getServiceCredentials } from './container-service';

/**
 * Build the `TF_VAR_*` env-var record for a single module. Returns
 * an empty record when the module isn't bound to a container service
 * (e.g. machine-pool deployments) or when credentials aren't
 * available. Never throws — failure to look up credentials is
 * surfaced as a missing var, which terraform will then complain
 * about in a way the caller already handles.
 */
export async function buildTerraformEnvForModule(
  moduleId: string,
  db: DbClient,
): Promise<Record<string, string>> {
  const infra = db
    .select()
    .from(moduleInfrastructure)
    .where(eq(moduleInfrastructure.moduleId, moduleId))
    .get();
  if (!infra || infra.infrastructureType !== 'container_service' || !infra.serviceId) {
    return {};
  }
  return await buildTerraformEnvForService(infra.serviceId);
}

/**
 * Build the `TF_VAR_*` env-var record for a container service
 * directly. Caller is responsible for already knowing the service
 * ID (e.g. via `planDeployment`).
 */
export async function buildTerraformEnvForService(
  serviceId: string,
): Promise<Record<string, string>> {
  const service = await getContainerService(serviceId);
  if (!service) return {};

  const credentials = await getServiceCredentials(serviceId);

  const env: Record<string, string> = {};
  if (service.providerName === 'digitalocean' && 'api_token' in credentials) {
    env.TF_VAR_digitalocean_token = credentials.api_token as string;
  } else if (service.providerName === 'proxmox' && 'api_url' in credentials) {
    env.TF_VAR_proxmox_api_url = credentials.api_url as string;
    env.TF_VAR_proxmox_token_id = credentials.api_token_id as string;
    env.TF_VAR_proxmox_token_secret = credentials.api_token_secret as string;
  }
  return env;
}