use crate::cli::commands;
use crate::cli::error::{CliError, CliResult};
use crate::commands::run_secrets;
use crate::logging::{log_file_only, LogLevel};
use colored::Colorize;
pub async fn handle_secrets(cmd: commands::SecretsCmd, debug: bool) -> CliResult<()> {
let action = describe_secrets_action(&cmd);
if let Err(e) = run_secrets(cmd, debug).await {
let _ = log_file_only(
LogLevel::Error,
"secrets",
"Secrets command failed",
Some(&e),
None,
)
.await;
return Err(CliError::Message(format_secrets_error(action, &e)));
}
Ok(())
}
fn describe_secrets_action(cmd: &commands::SecretsCmd) -> &'static str {
match cmd.command.as_ref() {
Some(commands::SecretsSubCommand::Push(_)) => "push local env vars to the provider",
Some(commands::SecretsSubCommand::Pull(_)) => {
"pull provider variables into a local env file"
}
Some(commands::SecretsSubCommand::Diff) => "compare local env vars with the provider",
Some(commands::SecretsSubCommand::Diag) => "diagnose provider access",
Some(commands::SecretsSubCommand::List(_)) => "list local env vars",
Some(commands::SecretsSubCommand::GenerateDefault(_)) => "generate .env.default",
Some(commands::SecretsSubCommand::GenerateExample(_)) => "generate .env.example",
Some(commands::SecretsSubCommand::Verify) => "verify local env coverage",
Some(commands::SecretsSubCommand::Providers) => "list supported providers",
Some(commands::SecretsSubCommand::Stores(_)) => "manage Cloudflare stores",
Some(commands::SecretsSubCommand::Secrets(_)) => "manage Cloudflare secrets",
Some(commands::SecretsSubCommand::Quota(_)) => "inspect Cloudflare secrets quota",
Some(commands::SecretsSubCommand::Usage) | None => "run the secrets workflow",
}
}
fn format_secrets_error(action: &str, details: &str) -> String {
[
format!(
"{} {}",
"SECRETS".bright_red().bold(),
"workflow failed".bright_white().bold()
),
format!(" {} {}", "Action:".bright_black(), action),
format!(" {} {}", "Reason:".bright_black(), details),
format!(
" {} {}",
"Hint:".bright_yellow().bold(),
"Use `xbp secrets --help`, run `xbp config github set-key`, or authenticate `gh`."
),
]
.join("\n")
}