package config

import "strings"

// MaskedSecret is the placeholder written in place of a stored secret whenever a
// configuration payload leaves the process. Every layer that masks or preserves
// configuration secrets shares this sentinel so a masked read round-trips into a
// write without silently overwriting the stored value.
const MaskedSecret = "******"

// IsMaskedSecret reports whether an inbound value carries no new secret, either
// because it was omitted or because it is the mask handed out on read.
func IsMaskedSecret(value string) bool {
	return strings.TrimSpace(value) == "" || strings.TrimSpace(value) == MaskedSecret
}

// ObjectStores lists every object-store block of a storage configuration so
// callers iterate the providers instead of repeating the list.
func ObjectStores(value *Storage) []*ObjectStore {
	if value == nil {
		return nil
	}
	return []*ObjectStore{value.AliyunOSS, value.HuaweiOBS, value.TencentCOS, value.AWSS3, value.CloudflareR2, value.Minio}
}

// MaskStorageSecrets replaces every populated storage secret with MaskedSecret.
func MaskStorageSecrets(value *Storage) {
	if value == nil {
		return
	}
	if value.Qiniu != nil && value.Qiniu.SecretKey != "" {
		value.Qiniu.SecretKey = MaskedSecret
	}
	for _, item := range ObjectStores(value) {
		if item != nil && item.SecretKey != "" {
			item.SecretKey = MaskedSecret
		}
	}
}