package config

import configkit "gitea.maximumdirect.net/eric/ConfigKit"

// MarshalYAML exposes only public credential reference names. Resolved values
// remain available solely through ConfigKit's explicit trusted accessor.
func (cfg StorageS3Config) MarshalYAML() (any, error) {
	type safeStorageS3 struct {
		Bucket          string  `yaml:"bucket"`
		RootPrefix      string  `yaml:"root_prefix"`
		Region          string  `yaml:"region"`
		Endpoint        string  `yaml:"endpoint"`
		ForcePathStyle  bool    `yaml:"force_path_style"`
		AccessKeyID     *string `yaml:"access_key_id,omitempty"`
		SecretAccessKey *string `yaml:"secret_access_key,omitempty"`
	}
	return safeStorageS3{
		Bucket: cfg.Bucket, RootPrefix: cfg.RootPrefix, Region: cfg.Region,
		Endpoint: cfg.Endpoint, ForcePathStyle: cfg.ForcePathStyle,
		AccessKeyID: secretReferenceName(cfg.AccessKeyID), SecretAccessKey: secretReferenceName(cfg.SecretAccessKey),
	}, nil
}

// MarshalYAML exposes only the public Audita credential reference name.
func (cfg AuditaConfig) MarshalYAML() (any, error) {
	type safeAudita struct {
		Binary                   string   `yaml:"binary"`
		Timeout                  string   `yaml:"timeout"`
		LLMAPIKey                *string  `yaml:"llm_api_key,omitempty"`
		Modules                  []string `yaml:"modules"`
		BaseURL                  string   `yaml:"base_url"`
		Model                    string   `yaml:"model"`
		TotalLLMConcurrency      *int     `yaml:"total_llm_concurrency"`
		ProposalLLMConcurrency   *int     `yaml:"proposal_llm_concurrency"`
		ValidationModel          string   `yaml:"validation_model"`
		ValidationLLMConcurrency *int     `yaml:"validation_llm_concurrency"`
		TranscriptDescription    string   `yaml:"transcript_description"`
		ConfigPath               string   `yaml:"config_path"`
		OutputSchema             string   `yaml:"output_schema"`
		WorkDirRetention         string   `yaml:"work_dir_retention"`
		Report                   *bool    `yaml:"report"`
	}
	return safeAudita{
		Binary: cfg.Binary, Timeout: cfg.Timeout, LLMAPIKey: secretReferenceName(cfg.LLMAPIKey),
		Modules: cfg.Modules, BaseURL: cfg.BaseURL, Model: cfg.Model,
		TotalLLMConcurrency: cfg.TotalLLMConcurrency, ProposalLLMConcurrency: cfg.ProposalLLMConcurrency,
		ValidationModel: cfg.ValidationModel, ValidationLLMConcurrency: cfg.ValidationLLMConcurrency,
		TranscriptDescription: cfg.TranscriptDescription, ConfigPath: cfg.ConfigPath,
		OutputSchema: cfg.OutputSchema, WorkDirRetention: cfg.WorkDirRetention, Report: cfg.Report,
	}, nil
}

func secretReferenceName(secret *configkit.Secret) *string {
	if secret == nil {
		return nil
	}
	name := secret.EnvName()
	return &name
}