package secretsource

import (
	"context"
	"fmt"

	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"

	awsconfig "github.com/aws/aws-sdk-go-v2/config"
	"github.com/tidbcloud/devops/pkg/infra/config"
)

type sourceAWSASM struct {
	client *secretsmanager.Client
}

func NewAWSASMSecretSource(conf config.SecretSourceAWSASM) (SecretSource, error) {
	awsConf, err := awsconfig.LoadDefaultConfig(context.Background(), awsconfig.WithRegion(conf.Region))
	if err != nil {
		return nil, fmt.Errorf("failed to load aws config: %w", err)
	}

	client := secretsmanager.NewFromConfig(awsConf)
	return &sourceAWSASM{
		client: client,
	}, nil
}

func (s *sourceAWSASM) GetSecretValue(ctx context.Context, name string) (string, error) {
	request := &secretsmanager.GetSecretValueInput{
		SecretId: &name,
	}
	response, err := s.client.GetSecretValue(ctx, request)
	if err != nil {
		return "", fmt.Errorf("failed to get secret from aws asm: %w", err)
	}
	if response.SecretString == nil {
		return "", fmt.Errorf("secret data is empty")
	}

	return *response.SecretString, nil
}