package store

import (
	"context"
	"database/sql"
	"errors"
	"fmt"
	"time"
)

// GetHostCredentials returns the AEAD-encrypted repo creds blob for
// the host, or ("", ErrNotFound) if no credential has ever been set.
// The caller decrypts using host_id as AEAD additional data.
func (s *Store) GetHostCredentials(ctx context.Context, hostID string) (string, error) {
	row := s.db.QueryRowContext(ctx,
		`SELECT enc_repo_creds FROM host_credentials WHERE host_id = ?`,
		hostID)
	var enc string
	if err := row.Scan(&enc); err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return "", ErrNotFound
		}
		return "", fmt.Errorf("store: get host credentials: %w", err)
	}
	return enc, nil
}

// SetHostCredentials replaces the host's encrypted repo creds blob.
// The caller has already encrypted using host_id as additional data.
func (s *Store) SetHostCredentials(ctx context.Context, hostID, encRepoCreds string) error {
	if encRepoCreds == "" {
		return fmt.Errorf("store: empty enc_repo_creds")
	}
	now := time.Now().UTC().Format(time.RFC3339Nano)
	_, err := s.db.ExecContext(ctx,
		`INSERT INTO host_credentials (host_id, enc_repo_creds, updated_at)
		 VALUES (?, ?, ?)
		 ON CONFLICT(host_id) DO UPDATE SET
			enc_repo_creds = excluded.enc_repo_creds,
			updated_at     = excluded.updated_at`,
		hostID, encRepoCreds, now)
	if err != nil {
		return fmt.Errorf("store: set host credentials: %w", err)
	}
	return nil
}