//! The secret broker daemon (spec §15). Runs as its own process; only the
//! server process can reach its socket — agent sandboxes have no route to
//! it by construction.
//!
//! Configuration (environment):
//! - `CLAWMATES_DATABASE__URL`     Postgres connection string (required)
//! - `CLAWMATES_BROKER_SOCKET`     unix socket path (default /tmp/clawmates-broker.sock)
//! - `CLAWMATES_BROKER_KEY_FILE`   master key file; generated on first boot
//! - `CLAWMATES_BROKER_POOL_SIZE`  max Postgres connections (default 8)

use std::path::PathBuf;
use std::process::ExitCode;

use cm_secrets::{BrokerServer, FileKey};

#[tokio::main]
async fn main() -> ExitCode {
    match run().await {
        Ok(()) => ExitCode::SUCCESS,
        Err(message) => {
            eprintln!("clawmates-broker: {message}");
            ExitCode::FAILURE
        }
    }
}

async fn run() -> Result<(), String> {
    let database_url = std::env::var("CLAWMATES_DATABASE__URL")
        .map_err(|_| "CLAWMATES_DATABASE__URL is required")?;
    let socket_path = PathBuf::from(
        std::env::var("CLAWMATES_BROKER_SOCKET")
            .unwrap_or_else(|_| "/tmp/clawmates-broker.sock".into()),
    );
    let key_path = PathBuf::from(
        std::env::var("CLAWMATES_BROKER_KEY_FILE")
            .unwrap_or_else(|_| "/etc/clawmates/broker.key".into()),
    );

    if !key_path.exists() {
        FileKey::generate(&key_path).map_err(|e| format!("key generation failed: {e}"))?;
        println!(
            "clawmates-broker: generated master key at {} — BACK IT UP; \
             secrets are unrecoverable without it",
            key_path.display()
        );
    }
    let key = FileKey::load(&key_path).map_err(|e| format!("key load failed: {e}"))?;

    // Pool size defaults to 8: one broker connection per concurrent door
    // execution before we start queueing. Tune via env when the fleet grows.
    let pool_size: u32 = std::env::var("CLAWMATES_BROKER_POOL_SIZE")
        .ok()
        .and_then(|v| v.parse().ok())
        .unwrap_or(8);
    let pool = cm_db::connect(&database_url, pool_size)
        .await
        .map_err(|e| format!("database connection failed: {e}"))?;

    println!("clawmates-broker listening on {}", socket_path.display());
    BrokerServer::new(pool, key, socket_path)
        .serve()
        .await
        .map_err(|e| format!("broker failed: {e}"))
}