from sqlalchemy.orm import Session

from app.core.secrets_crypto import decrypt_secret, encrypt_secret
from app.models.system import AppConfig

SECRET_CONFIG_KEYS = frozenset({"smtp.password"})


def get_config(db: Session, key: str, default: str = "") -> str:
    row = db.query(AppConfig).filter(AppConfig.key == key).first()
    if not row:
        return default
    if key in SECRET_CONFIG_KEYS:
        return decrypt_secret(row.value)
    return row.value


def set_config(db: Session, key: str, value: str) -> None:
    stored = encrypt_secret(value) if key in SECRET_CONFIG_KEYS else value
    row = db.query(AppConfig).filter(AppConfig.key == key).first()
    if row:
        row.value = stored
    else:
        db.add(AppConfig(key=key, value=stored))
    db.commit()


def has_secret_config(db: Session, key: str) -> bool:
    return db.query(AppConfig).filter(AppConfig.key == key).first() is not None