package device

import (
	"context"
	"fmt"
	"sync/atomic"
)

type Credential struct {
	Username string
	Password string
}

var activeService atomic.Pointer[Service]

// ReadCredential is an internal adapter port. Credentials must never be
// returned from HTTP handlers, logged, or placed in a URL.
func ReadCredential(ctx context.Context, id string) (Credential, error) {
	service := activeService.Load()
	if service == nil {
		return Credential{}, fmt.Errorf("device service is not ready")
	}
	item, err := service.store.Get(ctx, id)
	if err != nil {
		return Credential{}, err
	}
	if len(item.CredentialCiphertext) == 0 {
		return Credential{}, fmt.Errorf("device credential is not configured")
	}
	username, password, err := service.vault.Decrypt(item.CredentialCiphertext)
	return Credential{Username: username, Password: password}, err
}