pub const IMAP_PASSWORD: &str = "imap_password";
pub const SMTP_PASSWORD: &str = "smtp_password";
pub const PROTON_PASSWORD: &str = "proton_password";
pub const PROTON_MAILBOX_PASSWORD: &str = "proton_mailbox_password";
pub const BRIDGE_LOCAL_PASSWORD: &str = "bridge_local_password";

const SERVICE: &str = "tuimail";

pub fn get(key: &str) -> Result<String, String> {
    // 1. OS keychain
    let keychain_err = match keyring::Entry::new(SERVICE, key) {
        Ok(entry) => match entry.get_password() {
            Ok(val) => return Ok(val),
            Err(e) => format!("{e}"),
        },
        Err(e) => format!("entry creation failed: {e}"),
    };
    // 2. env var: TUIMAIL_<KEY_UPPERCASE>
    let env_key = format!("TUIMAIL_{}", key.to_uppercase());
    std::env::var(&env_key).map_err(|_| {
        format!(
            "Credential '{key}' not found (keychain: {keychain_err}). \
             Run with --configure to set up credentials, or set {env_key}."
        )
    })
}

pub fn set(key: &str, value: &str) -> Result<(), String> {
    keyring::Entry::new(SERVICE, key)
        .map_err(|e| e.to_string())?
        .set_password(value)
        .map_err(|e| e.to_string())
}

pub fn delete(key: &str) {
    if let Ok(entry) = keyring::Entry::new(SERVICE, key) {
        let _ = entry.delete_credential();
    }
}