// 密钥安全存储：用 Electron safeStorage 加密后写入 userData/secrets.json
// name 取 "github" / "registry"。读时解密；无则返回空串。
const fs = require("fs");
const path = require("path");
const { app, safeStorage } = require("electron");

function secretsPath() {
  return path.join(app.getPath("userData"), "secrets.json");
}

function readStore() {
  try {
    const txt = fs.readFileSync(secretsPath(), "utf-8");
    return JSON.parse(txt || "{}");
  } catch (e) {
    return {};
  }
}

function writeStore(store) {
  const p = secretsPath();
  fs.mkdirSync(path.dirname(p), { recursive: true });
  fs.writeFileSync(p, JSON.stringify(store, null, 2), { encoding: "utf-8" });
  try {
    fs.chmodSync(p, 0o600);
  } catch (e) {
    /* 忽略权限设置失败（非 POSIX 平台） */
  }
}

// 取密钥；无则空串
function getSecret(name) {
  const store = readStore();
  const enc = store[name];
  if (!enc) return "";
  try {
    if (safeStorage.isEncryptionAvailable()) {
      return safeStorage.decryptString(Buffer.from(enc, "base64"));
    }
    // 加密不可用时的降级：明文（base64）存储
    return Buffer.from(enc, "base64").toString("utf-8");
  } catch (e) {
    return "";
  }
}

// 存密钥；空值视为删除
function setSecret(name, value) {
  const store = readStore();
  if (!value) {
    delete store[name];
    writeStore(store);
    return { ok: true };
  }
  let encB64;
  if (safeStorage.isEncryptionAvailable()) {
    encB64 = safeStorage.encryptString(value).toString("base64");
  } else {
    encB64 = Buffer.from(value, "utf-8").toString("base64");
  }
  store[name] = encB64;
  writeStore(store);
  return { ok: true };
}

module.exports = { getSecret, setSecret };