import 'package:flutter_secure_storage/flutter_secure_storage.dart';

/// Encrypted storage backed by the OS keystore: Keychain (macOS/iOS),
/// Keystore/EncryptedSharedPreferences (Android), DPAPI (Windows) and
/// libsecret (Linux). Server passwords live here; so does anything else the
/// `internal_memory` brick generates with `secure: true`.
class SecretStore {
  static const _storage = FlutterSecureStorage(aOptions: AndroidOptions());

  static String _passwordKey(String serverId) => 'peach.pw.$serverId';

  /// The key this app used before it was renamed. Reads fall back to it once
  /// and migrate the value forward, so an existing install doesn't silently
  /// lose every stored password on upgrade.
  static String _legacyPasswordKey(String serverId) => 'jarpilot.pw.$serverId';

  Future<String?> readPassword(String serverId) async {
    final current = await _storage.read(key: _passwordKey(serverId));
    if (current != null) return current;

    final legacy = await _storage.read(key: _legacyPasswordKey(serverId));
    if (legacy == null) return null;
    await _storage.write(key: _passwordKey(serverId), value: legacy);
    await _storage.delete(key: _legacyPasswordKey(serverId));
    return legacy;
  }

  Future<void> writePassword(String serverId, String password) =>
      _storage.write(key: _passwordKey(serverId), value: password);

  Future<void> deletePassword(String serverId) async {
    await _storage.delete(key: _passwordKey(serverId));
    await _storage.delete(key: _legacyPasswordKey(serverId));
  }

  // ── generic access ─────────────────────────────────────────────────────────
  // Used by fields the `internal_memory` brick generates as secure.

  static Future<String?> read(String key) => _storage.read(key: key);

  static Future<void> write(String key, String value) =>
      _storage.write(key: key, value: value);

  static Future<void> delete(String key) => _storage.delete(key: key);
}