use serde::Deserialize;
use serde_json::json;

use super::{common, ToolResult};

#[derive(Debug, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct RevokeParams {
    pub name: String,
}

pub async fn execute(params: RevokeParams) -> ToolResult {
    common::validate_secret_name(&params.name, "name")?;
    let vault = envseal::vault::Vault::open_default().map_err(|e| e.to_string())?;
    envseal::ops::revoke_with_policy(&vault, &params.name).map_err(|e| e.to_string())?;

    Ok(json!({
        "revoked": true,
        "name": params.name
    }))
}
