use serde::Deserialize;
use serde_json::json;

use super::{common, ToolResult};

#[derive(Debug, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct PolicyShowParams {}

#[derive(Debug, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct PolicyRevokeParams {
    pub binary_path: String,
}

pub async fn show(_params: PolicyShowParams) -> ToolResult {
    let rules = envseal::ops::policy_show().map_err(|e| e.to_string())?;

    Ok(json!({
        "rules": rules.iter().map(|rule| json!({
            "binary": rule.binary,
            "scope": rule.scope,
            "secret": rule.secret
        })).collect::<Vec<_>>()
    }))
}

pub async fn revoke_binary(params: PolicyRevokeParams) -> ToolResult {
    common::require_trimmed_non_empty(&params.binary_path, "binary_path")?;
    common::validate_bounded_string(
        &params.binary_path,
        "binary_path",
        common::MAX_STRING_LENGTH,
    )?;
    envseal::ops::policy_revoke_binary(&params.binary_path).map_err(|e| e.to_string())?;

    Ok(json!({
        "revoked": true,
        "binary_path": params.binary_path
    }))
}
