"""Build per-service Vault Agent configs (no secret values in configs)."""
import json
from pathlib import Path

BASE = (Path(__file__).parent / 'vault' / 'agent.hcl').read_text()


def kv(path, field):
    return '{{ with secret "kv/data/' + path + '" }}{{ .Data.data.' + field + ' }}{{ end }}'


def config(service):
    env = {}
    if service == 'nats':
        env['NATS_TOKEN'] = kv('nats', 'token')
    else:
        env['TLS_CA'] = kv('tls', 'ca')
        if service == 'bff':
            env['SXCHNGE_JWT_SECRET'] = kv('bff', 'jwt')
            env['SXCHNGE_NOTIFICATIONS_TOKEN'] = kv('caller', 'token')
        else:
            env['SXCHNGE_NOTIFICATIONS_PRODUCT_TOKEN'] = kv('caller', 'token')
            env['SXCHNGE_NATS_URL'] = ('{{ with secret "kv/data/nats" }}'
                'nats://{{ .Data.data.token }}@nats:4222{{ end }}')
            env['TLS_CERT'] = kv('notifications-tls', 'certificate')
            env['TLS_KEY'] = kv('notifications-tls', 'private_key')
            env['EMAIL_API_KEY'] = kv('email', 'api_key')
            # JSON is valid YAML and escapes arbitrary provider configuration.
            env['EMAIL_CONFIG'] = ('{{ with secret "kv/data/email" }}'
                'email:\n  driver: {{ .Data.data.driver | toJSON }}\n'
                '  settings:\n    api_key_env: EMAIL_API_KEY\n'
                '    sender_address: {{ .Data.data.sender_address | toJSON }}\n'
                '    sender_name: {{ .Data.data.sender_name | toJSON }}\n{{ end }}')
    result = BASE
    for name, template in env.items():
        result += '\nenv_template ' + json.dumps(name) + ' {\n  contents = ' + json.dumps(template) + '\n  error_on_missing_key = true\n}\n'
    command = '/usr/local/bin/start-nats' if service == 'nats' else '/usr/local/bin/start-service'
    result += '\nexec {\n  command = [' + json.dumps(command) + ']\n  restart_on_secret_changes = "always"\n  restart_stop_signal = "SIGTERM"\n}\n'
    return result