package commands

import (
	"os"
	"strings"

	"git.hangman-lab.top/zhi/HarborForge.Cli/internal/mode"
	"git.hangman-lab.top/zhi/HarborForge.Cli/internal/output"
	"git.hangman-lab.top/zhi/HarborForge.Cli/internal/passmgr"
)

// ResolveToken resolves the auth token based on runtime mode.
// In padded-cell mode, tokenFlag must be empty (enforced).
// In manual mode, tokenFlag is required.
func ResolveToken(tokenFlag string) string {
	if mode.IsPaddedCell() {
		if tokenFlag != "" {
			output.Error("padded-cell installed, --token flag disabled, use command directly")
		}
		tok, err := passmgr.GetToken()
		if err != nil {
			output.Errorf("cannot resolve token: %v", err)
		}
		return tok
	}
	// manual mode — prefer the explicit flag, else fall back to the HF_TOKEN
	// env var so the token need not appear in argv (visible via `ps`/history).
	if tokenFlag != "" {
		return tokenFlag
	}
	if env := strings.TrimSpace(os.Getenv("HF_TOKEN")); env != "" {
		return env
	}
	output.Error("--token <token> or HF_TOKEN env required, or execute this with pcexec")
	return ""
}

// RejectTokenInPaddedCell checks if --token was passed in padded-cell mode
// and terminates with the standard error message.
func RejectTokenInPaddedCell(tokenFlag string) {
	if mode.IsPaddedCell() && tokenFlag != "" {
		output.Error("padded-cell installed, --token flag disabled, use command directly")
	}
}