import type { DeploymentSettings } from "@rakazo/db";

type SecretLoader = {
  load(ciphertext: string, recordId: string): string;
};

/** Injects the deployment owner's GitHub token into project computer shells only. */
export function ownerGithubEnvironmentForRun(input: {
  settings: Pick<DeploymentSettings, "ownerUserId" | "ownerGithubTokenCipher"> | null;
  userId: string;
  spaceIsDefault: boolean;
  secrets: SecretLoader;
}): Record<string, string> {
  if (input.spaceIsDefault) return {};
  if (!input.settings?.ownerGithubTokenCipher) return {};
  if (input.settings.ownerUserId !== input.userId) return {};
  const token = input.secrets.load(
    input.settings.ownerGithubTokenCipher,
    "deployment-github-token",
  );
  if (!token.trim()) return {};
  return { GITHUB_TOKEN: token, GH_TOKEN: token };
}