package automation

import (
	"context"
	"strings"

	"github.com/tidbcloud/AgentTeam/internal/automation/dsl"
)

func (s *AutomationsService) validateAutomationSecretReferences(ctx context.Context, workspaceID string, subject string, owner string, repo string, spec dsl.DefinitionSpec) error {
	secretNames, err := dsl.SecretReferences(spec)
	if err != nil {
		return invalidArgument("Automation spec is invalid")
	}
	if len(secretNames) == 0 {
		return nil
	}
	owner, repo = normalizeAutomationSecretRepository(owner, repo)
	if err := validateAutomationRepository(owner, repo); err != nil {
		return err
	}
	if err := s.automationAuthorizer().CanUseAutomationSecret(ctx, s.automationAuthorizationRequest(ctx, workspaceID, subject, AutomationAuthorizationRequest{RepositoryOwner: owner, RepositoryName: repo})); err != nil {
		return err
	}
	existing, err := s.store.GetExistingAutomationSecretNames(ctx, strings.TrimSpace(workspaceID), owner, repo, secretNames)
	if err != nil {
		return err
	}
	missing := make([]string, 0)
	for _, name := range secretNames {
		if _, ok := existing[name]; !ok {
			missing = append(missing, name)
		}
	}
	if len(missing) == 0 {
		return nil
	}
	if len(missing) == 1 {
		return invalidArgument("Automation references missing secret: " + missing[0])
	}
	return invalidArgument("Automation references missing secrets: " + strings.Join(missing, ", "))
}