from __future__ import annotations

from typing import Any

from yuxi.utils.logging_config import logger

_SECRET_CONTRACTS: dict[str, dict[str, Any]] = {
    "serviceAccount": {
        "name": "serviceAccount",
        "description": "Google Chat service account JSON credentials (inline)",
        "required": True,
        "sensitive": True,
        "validate": "_validate_service_account_json",
    },
    "serviceAccountFile": {
        "name": "serviceAccountFile",
        "description": "Path to Google Chat service account JSON key file",
        "required": False,
        "sensitive": True,
    },
    "serviceAccountRef": {
        "name": "serviceAccountRef",
        "description": "Secret reference to Google Chat service account credentials",
        "required": False,
        "sensitive": True,
    },
    "webhookSecret": {
        "name": "webhookSecret",
        "description": "Webhook secret for Pub/Sub push endpoint (if applicable)",
        "required": False,
        "sensitive": True,
    },
}


def get_secret_contracts() -> dict[str, dict[str, Any]]:
    return dict(_SECRET_CONTRACTS)


def register_secret_contract(name: str, contract: dict[str, Any]) -> None:
    _SECRET_CONTRACTS[name] = contract
    logger.debug(f"Registered secret contract: {name}")


def get_required_secrets() -> list[str]:
    return [name for name, contract in _SECRET_CONTRACTS.items() if contract.get("required")]


def get_sensitive_fields() -> set[str]:
    return {name for name, contract in _SECRET_CONTRACTS.items() if contract.get("sensitive")}


def is_sensitive_field(field_name: str) -> bool:
    return field_name in get_sensitive_fields() or field_name.endswith("_key") or field_name.endswith("_secret")