from pathlib import Path

COLLECTION_NAME = 'platform_certificates'


class CertProvider:
    """Downloads the platform's client cert + private key (Mongo metadata,
    MinIO bytes) into a writable cache dir — pod root FS is read-only (§12),
    so `cache_dir` must be an emptyDir/tmpfs mount."""

    def __init__(self, mongo, minio, cache_dir: str, bucket: str, metadata: dict | None = None):
        self.mongo = mongo
        self.minio = minio
        self.cache_dir = cache_dir
        self.bucket = bucket
        self.metadata = metadata or {}

    async def fetch(self) -> tuple[str, str]:
        doc = await self.mongo.find_one(COLLECTION_NAME, {}, self.metadata)
        Path(self.cache_dir).mkdir(parents=True, exist_ok=True)
        cert_path = await self._download(doc['client_cert']['minio_object_name'])
        key_path = await self._download(doc['private_key']['minio_object_name'])
        return cert_path, key_path

    async def _download(self, object_name: str) -> str:
        data = await self.minio.download_file(object_name, self.bucket, self.metadata)
        local_path = str(Path(self.cache_dir) / Path(object_name).name)
        Path(local_path).write_bytes(data)
        return local_path