package config

import configkit "gitea.maximumdirect.net/eric/ConfigKit"

// MarshalYAML exposes only public credential reference names. Resolved values
// remain available solely through ConfigKit's explicit trusted accessor.
func (cfg StorageS3Config) MarshalYAML() (any, error) {
	type safeStorageS3 struct {
		Bucket          string  `yaml:"bucket"`
		RootPrefix      string  `yaml:"root_prefix"`
		Region          string  `yaml:"region"`
		Endpoint        string  `yaml:"endpoint"`
		ForcePathStyle  bool    `yaml:"force_path_style"`
		AccessKeyID     *string `yaml:"access_key_id,omitempty"`
		SecretAccessKey *string `yaml:"secret_access_key,omitempty"`
	}
	return safeStorageS3{
		Bucket: cfg.Bucket, RootPrefix: cfg.RootPrefix, Region: cfg.Region,
		Endpoint: cfg.Endpoint, ForcePathStyle: cfg.ForcePathStyle,
		AccessKeyID: secretReferenceName(cfg.AccessKeyID), SecretAccessKey: secretReferenceName(cfg.SecretAccessKey),
	}, nil
}

// MarshalYAML exposes only public Audita credential reference names.
func (cfg AuditaConfig) MarshalYAML() (any, error) {
	type safeAudita struct {
		Binary                string   `yaml:"binary"`
		Timeout               string   `yaml:"timeout"`
		Credentials           []string `yaml:"credentials,omitempty"`
		Modules               []string `yaml:"modules"`
		Overlay               string   `yaml:"overlay"`
		ProposalProfile       string   `yaml:"proposal_profile"`
		ValidationProfile     string   `yaml:"validation_profile"`
		TranscriptDescription string   `yaml:"transcript_description"`
		ConfigPath            string   `yaml:"config_path"`
		OutputSchema          string   `yaml:"output_schema"`
	}
	return safeAudita{
		Binary: cfg.Binary, Timeout: cfg.Timeout, Credentials: secretReferenceNames(cfg.Credentials),
		Modules: cfg.Modules, Overlay: cfg.Overlay, ProposalProfile: cfg.ProposalProfile,
		ValidationProfile: cfg.ValidationProfile, TranscriptDescription: cfg.TranscriptDescription,
		ConfigPath: cfg.ConfigPath, OutputSchema: cfg.OutputSchema,
	}, nil
}

// MarshalYAML exposes only public Notarius credential reference names.
func (cfg NotariusConfig) MarshalYAML() (any, error) {
	type safeNotarius struct {
		Enabled          bool                            `yaml:"enabled"`
		Binary           string                          `yaml:"binary"`
		Credentials      []string                        `yaml:"credentials,omitempty"`
		ConfigProfile    *string                         `yaml:"config_profile,omitempty"`
		Resume           bool                            `yaml:"resume,omitempty"`
		ChunkCache       string                          `yaml:"chunk_cache,omitempty"`
		ConfigPath       string                          `yaml:"config_path"`
		PipelineID       string                          `yaml:"pipeline_id"`
		Timeout          string                          `yaml:"timeout"`
		WorkingDirectory string                          `yaml:"working_directory"`
		References       map[string]string               `yaml:"references"`
		Outputs          map[string]NotariusOutputConfig `yaml:"outputs"`
	}
	return safeNotarius{
		Enabled: cfg.Enabled, Binary: cfg.Binary, Credentials: secretReferenceNames(cfg.Credentials),
		ConfigProfile: cfg.ConfigProfile,
		Resume:        cfg.Resume, ChunkCache: cfg.ChunkCache,
		ConfigPath: cfg.ConfigPath, PipelineID: cfg.PipelineID, Timeout: cfg.Timeout,
		WorkingDirectory: cfg.WorkingDirectory, References: cfg.References, Outputs: cfg.Outputs,
	}, nil
}

func secretReferenceNames(secrets []configkit.Secret) []string {
	if secrets == nil {
		return nil
	}
	names := make([]string, len(secrets))
	for index, secret := range secrets {
		names[index] = secret.EnvName()
	}
	return names
}

func secretReferenceName(secret *configkit.Secret) *string {
	if secret == nil {
		return nil
	}
	name := secret.EnvName()
	return &name
}