package app

import (
	"context"

	"github.com/dtoro/oikos/internal/core/ports"
)

// SecretsService is the secrets use-case surface. get/list are direct
// reads; Set is a direct write for the CLI/operator path — routing agent
// writes through the approval flow (plan §3.4) lands with the governance
// slice (PolicyService/ExecutionService), at which point the MCP
// set_secret tool converges here too.
type SecretsService struct {
	backend ports.Secrets
}

// NewSecretsService wires the service over a secrets backend
// (Infisical primary, SOPS DR fallback).
func NewSecretsService(backend ports.Secrets) *SecretsService {
	return &SecretsService{backend: backend}
}

// Get retrieves one secret value by key.
func (s *SecretsService) Get(ctx context.Context, key string) (string, error) {
	return s.backend.Get(ctx, key)
}

// List returns all secret keys (no values).
func (s *SecretsService) List(ctx context.Context) ([]string, error) {
	return s.backend.List(ctx)
}

// Set stores or updates a secret.
func (s *SecretsService) Set(ctx context.Context, key, value string) error {
	return s.backend.Set(ctx, key, value)
}

// Name reports the active backend (for diagnostics).
func (s *SecretsService) Name() string {
	return s.backend.Name()
}