<?php

namespace App\Support\Ssh;

use App\Models\Server;
use phpseclib3\Crypt\Common\AsymmetricKey;
use phpseclib3\Crypt\PublicKeyLoader;
use RuntimeException;

/**
 * Resolves a server's stored SSH credential into a usable phpseclib login
 * secret. Encryption-at-rest is handled by the SshCredential model
 * ('encrypted' casts via APP_KEY); this class never logs the secret.
 */
class CredentialVault
{
    /**
     * @return array{username: string, secret: AsymmetricKey|string}
     */
    public function resolve(Server $server): array
    {
        $cred = $server->credential;

        if (! $cred) {
            throw new RuntimeException(__('backend.no_ssh_credential', ['server' => $server->name]));
        }

        if ($cred->disabled_at !== null) {
            throw new RuntimeException(__('backend.ssh_access_locked', ['server' => $server->name]));
        }

        $secret = $cred->auth_type === 'key'
            ? PublicKeyLoader::load($cred->secret, $cred->passphrase ?: false)
            : $cred->secret; // password auth

        return ['username' => $cred->username, 'secret' => $secret];
    }
}