package configuration

import (
	"io"
	"strings"

	"gitea.maximumdirect.net/eric/ConfigKit"
)

// Inspection is the read-only subset of the retained ConfigKit result used by
// the facade. It does not expose typed configuration or resource contexts.
type Inspection interface {
	Metadata() configkit.Metadata
	Sources() []configkit.SourceInfo
	Diagnostics() []configkit.Diagnostic
	Explain(configkit.Path) (configkit.Explanation, bool)
	WriteEffective(io.Writer) error
	WriteExplanation(io.Writer, configkit.Path) error
	capturedResult() *configkit.Result[document]
}

type inspectionResult struct {
	*configkit.Result[document]
}

func (inspection inspectionResult) capturedResult() *configkit.Result[document] {
	return inspection.Result
}

// Inspection returns only the retained result's inspection operations.
func (state *loaded) Inspection() Inspection {
	if state == nil {
		return nil
	}
	return inspectionResult{Result: state.result}
}

// Diff compares two captured ConfigKit results without reconstructing them.
func Diff(left, right Inspection) ([]configkit.Difference, error) {
	var leftResult, rightResult *configkit.Result[document]
	if left != nil {
		leftResult = left.capturedResult()
	}
	if right != nil {
		rightResult = right.capturedResult()
	}
	return configkit.Diff(leftResult, rightResult)
}

func secretProviderPath(path configkit.Path) bool {
	pointer := path.String()
	if pointer == "" {
		return false
	}
	parts := strings.Split(strings.TrimPrefix(pointer, "/"), "/")
	if len(parts) < 4 || (parts[0] != "backends" && parts[0] != "profiles") || parts[2] != "extra_params" {
		return false
	}
	key := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(parts[len(parts)-1], "~1", "/"), "~0", "~"))
	switch key {
	case "api_key", "apikey", "authorization", "credential", "credentials", "password", "secret", "token", "access_token":
		return true
	default:
		return false
	}
}