package subprocess

import (
	"fmt"

	configkit "gitea.maximumdirect.net/eric/ConfigKit"
)

// CredentialEnvironment returns captured secret values and names for a child
// invocation. References must already have been resolved by ConfigKit.
func CredentialEnvironment(credentials []configkit.Secret) (map[string]string, []string, error) {
	if len(credentials) == 0 {
		return nil, nil, nil
	}
	overrides := make(map[string]string, len(credentials))
	names := make([]string, 0, len(credentials))
	for _, credential := range credentials {
		name := credential.EnvName()
		value := credential.Value()
		if !credential.IsResolved() || value == "" {
			return nil, nil, fmt.Errorf("credential %q must be resolved and nonempty", name)
		}
		if _, exists := overrides[name]; !exists {
			names = append(names, name)
			overrides[name] = value
		}
	}
	return overrides, names, nil
}