package auditloginit

import (
	"fmt"

	"github.com/pingcap-inc/clinic_cloud_server/pkg/config"
)

// ValidateKafkaExt checks kafka_ext when SASL is enabled.
func ValidateKafkaExt(cfg *config.Config) error {
	if cfg == nil || !cfg.KafkaExt.SASL.Enabled {
		return nil
	}
	if cfg.KafkaExt.SASL.Username == "" || cfg.KafkaExt.SASL.Password == "" {
		return fmt.Errorf("kafka_ext.sasl.username and kafka_ext.sasl.password are required when kafka_ext.sasl.enabled is true")
	}
	return nil
}