import { ConfigurationError, type Bindings } from "./validation.ts";

// Deliberate reveal is required at the consuming crypto/provider API. The raw
// value is not enumerable and ordinary diagnostics/JSON cannot serialize it.
export class Secret {
  #value: string;
  constructor(value: string) {
    this.#value = value;
  }
  reveal(): string {
    return this.#value;
  }
  toJSON(): string {
    return "[REDACTED]";
  }
  toString(): string {
    return "[REDACTED]";
  }
  [Symbol.for("nodejs.util.inspect.custom")](): string {
    return "[REDACTED]";
  }
}

export function requiredSecret(
  env: Bindings,
  key: string,
  minimumBytes = 32,
): Secret {
  const value = env[key];
  if (
    typeof value !== "string" ||
    value !== value.trim() ||
    new TextEncoder().encode(value).length < minimumBytes
  ) {
    throw new ConfigurationError(
      key,
      `set a Worker secret with at least ${minimumBytes} bytes using wrangler secret put (or .dev.vars locally)`,
    );
  }
  return new Secret(value);
}