package llm

import (
	"context"
	"os"
	"strings"

	"gitea.maximumdirect.net/eric/audita/v3/internal/core/redaction"
)

// ConfiguredSecrets obtains only values referenced by captured credential metadata.
// It never selects a credential or treats an absent value as an error.
func (r *Runtime) ConfiguredSecrets(ctx context.Context, additionalEnvNames ...string) []string {
	if r == nil || r.Engine == nil {
		return nil
	}
	ctx = context.WithoutCancel(ctx)
	names := make(map[string]struct{})
	add := func(name *string) {
		if name != nil && *name != "" {
			names[*name] = struct{}{}
		}
	}
	for _, name := range additionalEnvNames {
		add(&name)
	}
	if ids, err := r.Engine.ListProfiles(ctx); err == nil {
		for _, id := range ids {
			if profile, err := r.Engine.InspectProfile(ctx, id); err == nil {
				add(profile.APIKeyEnv)
			}
		}
	}
	if ids, err := r.Engine.ListBackends(ctx); err == nil {
		for _, id := range ids {
			if backend, err := r.Engine.InspectBackend(ctx, id); err == nil {
				add(backend.APIKeyEnv)
			}
		}
	}
	secrets := make([]string, 0, len(names))
	for name := range names {
		if value := os.Getenv(name); value != "" {
			secrets = append(secrets, value)
			// PromptKit trims the value before sending it to the provider.
			if trimmed := strings.TrimSpace(value); trimmed != "" && trimmed != value {
				secrets = append(secrets, trimmed)
			}
		}
	}
	return secrets
}

func (r *Runtime) RedactError(ctx context.Context, err error, additionalEnvNames ...string) string {
	if err == nil {
		return ""
	}
	return redaction.New(r.ConfiguredSecrets(ctx, additionalEnvNames...)).String(err.Error())
}