//! [`SecretBroker`] that refuses resolution and no-ops revoke — for stub-backend-only runs.

use async_trait::async_trait;

use crate::error::CellosError;
use crate::ports::SecretBroker;
use crate::types::SecretView;

/// No materialized secrets; use when the workload has no `secretRefs`.
pub struct NoopSecretBroker;

#[async_trait]
impl SecretBroker for NoopSecretBroker {
    async fn resolve(
        &self,
        key: &str,
        _cell_id: &str,
        _ttl_seconds: u64,
    ) -> Result<SecretView, CellosError> {
        Err(CellosError::SecretBroker(format!(
            "NoopSecretBroker: cannot resolve {key:?} (use MemorySecretBroker or a real broker)"
        )))
    }

    async fn revoke_for_cell(&self, _cell_id: &str) -> Result<(), CellosError> {
        Ok(())
    }
}
