package secretRU

import (
	"encoding/base64"
	"encoding/json"
	"fmt"

	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/secretsmanager"
)

// SecretData 用于解析 Secret JSON
type SecretData struct {
	Vul string `json:"vul"`
}

// 读取指定 Secret 的 vul 值
func ReadSecret(secretName, region string) (string, error) {
	// 创建会话
	sess, err := session.NewSession(&aws.Config{
		Region: aws.String(region),
	})
	if err != nil {
		return "", fmt.Errorf("unable to create session: %w", err)
	}

	client := secretsmanager.New(sess)

	// 获取 secret
	resp, err := client.GetSecretValue(&secretsmanager.GetSecretValueInput{
		SecretId: aws.String(secretName),
	})
	if err != nil {
		return "", fmt.Errorf("failed to get secret value: %w", err)
	}

	// 解析 JSON
	var secret SecretData
	if err := json.Unmarshal([]byte(*resp.SecretString), &secret); err != nil {
		return "", fmt.Errorf("failed to unmarshal secret JSON: %w", err)
	}

	return secret.Vul, nil
}

// 更新 Secret 中的 vul 字段，写入前先 base64
func UpdateSecret(secretName, region, newVulValue string) error {
	// base64 encode
	encoded := base64.StdEncoding.EncodeToString([]byte(newVulValue))

	// 封装 JSON
	secretData := SecretData{Vul: encoded}
	secretJSON, err := json.Marshal(secretData)
	if err != nil {
		return fmt.Errorf("failed to marshal secret JSON: %w", err)
	}

	// 创建会话
	sess, err := session.NewSession(&aws.Config{
		Region: aws.String(region),
	})
	if err != nil {
		return fmt.Errorf("unable to create session: %w", err)
	}

	client := secretsmanager.New(sess)

	// 更新 secret
	_, err = client.UpdateSecret(&secretsmanager.UpdateSecretInput{
		SecretId:     aws.String(secretName),
		SecretString: aws.String(string(secretJSON)),
	})
	if err != nil {
		return fmt.Errorf("failed to update secret: %w", err)
	}

	return nil
}