import { readFileSync } from "node:fs";

/** Lit un secret monté par Docker, sans jamais exposer son contenu aux logs. */
export function readSecretFile(path: string | undefined): string {
  if (!path) return "";
  try {
    return readFileSync(path, "utf8").trim();
  } catch {
    return "";
  }
}

/** Préfère un secret explicite, puis le secret Docker si la variable est absente ou vide. */
export function resolveServerSecret(value: string | undefined, secretPath: string | undefined): string {
  const environmentValue = value?.trim();
  return environmentValue || readSecretFile(secretPath);
}

export const ENV = {
  appId: process.env.VITE_APP_ID ?? "",
  cookieSecret: process.env.JWT_SECRET ?? "",
  databaseUrl: process.env.DATABASE_URL ?? "",
  oAuthServerUrl: process.env.OAUTH_SERVER_URL ?? "",
  ownerOpenId: process.env.OWNER_OPEN_ID ?? "",
  isProduction: process.env.NODE_ENV === "production",
  forgeApiUrl: process.env.BUILT_IN_FORGE_API_URL ?? "",
  forgeApiKey: process.env.BUILT_IN_FORGE_API_KEY ?? "",
  mistralApiKey: process.env.MISTRAL_API_KEY ?? "",
  geminiApiKey: process.env.GEMINI_API_KEY ?? "",
  referentielIaUrl: process.env.REFERENTIEL_IA_URL ?? "",
  referentielIaToken: resolveServerSecret(
    process.env.REFERENTIEL_IA_TOKEN,
    process.env.REFERENTIEL_IA_TOKEN_FILE,
  ),
};