from __future__ import annotations

from typing import Any

from knoe import config as inst_config

from .context import KnoeContext
from .k8s import apply_yaml


def resolve_secret_value(value: str | None) -> str:
    if not value:
        return ""
    return inst_config._resolve_secret_value(value)


def ensure_db_k8s_secrets(
    ctx: KnoeContext,
    *,
    namespace: str,
    name: str = "knoe-db",
    username: str | None = None,
    password: str | None = None,
    extra: dict[str, str] | None = None,
) -> None:
    """Ensure a Secret exists containing DB credentials.

    Stage 1 implementation is intentionally minimal and uses `kubectl apply`.
    """

    data: dict[str, Any] = {}
    if username is not None:
        data["username"] = resolve_secret_value(username)
    if password is not None:
        data["password"] = resolve_secret_value(password)
    if extra:
        for k, v in extra.items():
            data[k] = resolve_secret_value(v)

    # We keep this as stringData for readability; kubectl will base64-encode.
    yaml_lines = [
        "apiVersion: v1",
        "kind: Secret",
        "metadata:",
        f"  name: {name}",
        f"  namespace: {namespace}",
        "type: Opaque",
        "stringData:",
    ]
    for k, v in data.items():
        yaml_lines.append(f"  {k}: {v}")
    apply_yaml(ctx, "\n".join(yaml_lines) + "\n", namespace=namespace)