//! CLI driver — exercises the full secret round-trip against the real
//! platform secure storage.

use std::process::ExitCode;

use secure_storage_spike::secret::Secret;
use secure_storage_spike::SecretStorageRepository;
use tracing::info;

const SERVICE: &str = "app.chanora.poc.secure-storage";

fn main() -> ExitCode {
    tracing_subscriber::fmt()
        .with_env_filter(
            tracing_subscriber::EnvFilter::try_from_default_env()
                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
        )
        .init();

    if let Err(e) = run() {
        eprintln!("error: {e}");
        return ExitCode::from(1);
    }
    ExitCode::SUCCESS
}

fn run() -> Result<(), Box<dyn std::error::Error>> {
    #[cfg(not(target_os = "linux"))]
    {
        eprintln!("This PoC currently only ships a Linux adapter.");
        return Err("unsupported platform".into());
    }

    #[cfg(target_os = "linux")]
    {
        use secure_storage_spike::secret::linux::LinuxSecureStore;

        // Try Secret Service first (preferred per ADR-006); fall back to
        // keyutils if the default collection is locked or unavailable.
        let store: Box<dyn SecretStorageRepository> = {
            let ss = LinuxSecureStore::new(SERVICE);
            let probe = ss.set("__chanora_probe__", &Secret::from_utf8("probe"));
            match probe {
                Ok(()) => {
                    let _ = ss.delete("__chanora_probe__");
                    info!(target: "spike", "using Secret Service backend");
                    Box::new(ss)
                }
                Err(e) => {
                    info!(target: "spike", "Secret Service unavailable ({e}); falling back to keyutils");
                    Box::new(LinuxSecureStore::new_keyutils(SERVICE))
                }
            }
        };

        let name = "identity.primary";

        info!(target: "spike", "writing secret {}", name);
        let original = Secret::from_utf8("MG0DAgeAAgEgAiAIXJBlj1hQbaH0Eq0DuLlCmH8bl+veTAO2");
        store.set(name, &original)?;

        info!(target: "spike", "reading back");
        let round_trip = store.get(name)?;
        assert_eq!(original, round_trip, "round-trip mismatch");
        info!(target: "spike", "round-trip OK ({} bytes)", round_trip.len());

        info!(target: "spike", "deleting");
        store.delete(name)?;
        match store.get(name) {
            Err(secure_storage_spike::SecureStoreError::NotFound) => {
                info!(target: "spike", "post-delete read correctly returned NotFound");
            }
            Ok(_) => return Err("secret still readable after delete".into()),
            Err(e) => return Err(format!("unexpected error after delete: {e}").into()),
        }

        println!("OK — Linux Secret Service round-trip verified.");
        Ok(())
    }
}