//! secret: manage secrets in the OS keyring (values never shown or logged).

use super::*;
use crate::cli::SecretCmd;
use crate::output::print_json;
use crate::secrets::{self, SecretStore};

pub fn run(app: &App, sub: &SecretCmd) -> Result<i32> {
    match sub {
        SecretCmd::Set { name, agent, value } => {
            if app.dry_run() {
                app.log.dry(format!("would store secret {name} for {agent} in the OS keyring"));
                return Ok(0);
            }
            let key = secrets::key_for(agent, name);
            secrets::store().set(&key, value)?;
            app.log.success(&format!("secret {name} stored for {agent}"));
            app.log.info("use it with --env NAME=@secret (injected at start/run)");
            Ok(0)
        }
        SecretCmd::Unset { name, agent } => {
            let key = secrets::key_for(agent, name);
            if app.dry_run() {
                app.log.dry(format!("would remove secret {key}"));
                return Ok(0);
            }
            let removed = secrets::store().remove(&key)?;
            if removed {
                app.log.success(&format!("secret {name} removed for {agent}"));
            } else {
                app.log.info(&format!("secret {name} does not exist for {agent}"));
            }
            Ok(0)
        }
        SecretCmd::List => {
            let all = secrets::store().list().unwrap_or_default();
            if app.json() {
                print_json(&all);
                return Ok(0);
            }
            if all.is_empty() {
                app.log.info("no secrets stored — see: am secret set NAME --agent AGENT --value ...");
                return Ok(0);
            }
            let mut table = crate::output::Table::new(vec!["SECRET"]);
            for k in all {
                if k != "__index__" {
                    table.row(vec![k]);
                }
            }
            print!("{}", table.render());
            Ok(0)
        }
    }
}