/**
 * Slack Credentials Persistence Service
 *
 * Persists Slack tokens to ~/.crewly/slack-credentials.json so that
 * tokens configured via the /settings UI survive server restarts.
 * The file is written with 0600 permissions to protect secrets.
 *
 * @module services/slack/slack-credentials
 */
import * as path from 'path';
import * as fs from 'fs/promises';
import { atomicWriteJson, safeReadJson } from '../../utils/file-io.utils.js';
import { LoggerService } from '../core/logger.service.js';
const logger = LoggerService.getInstance().createComponentLogger('SlackCredentials');
const CREDENTIALS_FILE = 'slack-credentials.json';
/**
 * Get the path to the Slack credentials file.
 *
 * @returns Absolute path to ~/.crewly/slack-credentials.json
 */
function getCredentialsPath() {
    const crewlyHome = path.join(process.env.HOME || '~', '.crewly');
    return path.join(crewlyHome, CREDENTIALS_FILE);
}
/**
 * Save Slack credentials to disk with restricted file permissions (0600).
 *
 * @param config - The SlackConfig to persist.
 */
export async function saveSlackCredentials(config) {
    const filePath = getCredentialsPath();
    const credentials = {
        botToken: config.botToken,
        appToken: config.appToken,
        signingSecret: config.signingSecret,
        defaultChannelId: config.defaultChannelId,
        allowedUserIds: config.allowedUserIds,
    };
    await atomicWriteJson(filePath, credentials);
    // Restrict permissions to owner-only (0600)
    try {
        await fs.chmod(filePath, 0o600);
    }
    catch (error) {
        logger.warn('Failed to set credentials file permissions', {
            error: error instanceof Error ? error.message : String(error),
        });
    }
    logger.info('Slack credentials saved to disk');
}
/**
 * Load saved Slack credentials from disk.
 *
 * @returns SlackConfig if credentials file exists and is valid, null otherwise.
 */
export async function loadSlackCredentials() {
    const filePath = getCredentialsPath();
    const credentials = await safeReadJson(filePath, null, logger);
    if (!credentials || !credentials.botToken || !credentials.appToken || !credentials.signingSecret) {
        return null;
    }
    return {
        botToken: credentials.botToken,
        appToken: credentials.appToken,
        signingSecret: credentials.signingSecret,
        defaultChannelId: credentials.defaultChannelId,
        allowedUserIds: credentials.allowedUserIds,
        socketMode: true,
    };
}
/**
 * Delete saved Slack credentials from disk.
 */
export async function deleteSlackCredentials() {
    const filePath = getCredentialsPath();
    try {
        await fs.unlink(filePath);
        logger.info('Slack credentials removed from disk');
    }
    catch (error) {
        if (error.code !== 'ENOENT') {
            logger.warn('Failed to delete credentials file', {
                error: error instanceof Error ? error.message : String(error),
            });
        }
    }
}
/**
 * Check if saved Slack credentials exist on disk.
 *
 * @returns True if the credentials file exists.
 */
export async function hasSavedCredentials() {
    const filePath = getCredentialsPath();
    try {
        await fs.access(filePath);
        return true;
    }
    catch {
        return false;
    }
}
//# sourceMappingURL=slack-credentials.service.js.map