import { Injectable } from '@nestjs/common';
import { PinoLogger } from 'nestjs-pino';

import { AppConfig } from './app-config.service';
import { readSecretsFile, writeSecretsFile } from './secret-store';

/**
 * Injectable facade over the env-backed secret store file (secret-store.ts).
 * Reading goes to disk every time — writes are rare (setup wizard) and the
 * only frequent reader (SmtpConfigService) caches on its own terms.
 */
@Injectable()
export class SecretStoreService {
  constructor(
    private readonly config: AppConfig,
    private readonly logger: PinoLogger,
  ) {
    this.logger.setContext(SecretStoreService.name);
  }

  read(): Record<string, string> {
    return readSecretsFile(this.config.env.SECRETS_FILE);
  }

  async set(entries: Record<string, string>): Promise<void> {
    await writeSecretsFile(this.config.env.SECRETS_FILE, entries);
    this.logger.info({ keys: Object.keys(entries) }, 'audit: secret store updated');
  }
}