package api

import (
	"database/sql"
	"encoding/json"
	"net/http"
)

// handleOffsiteConsumePassword serves the one-time transient offsite password to the controller EXACTLY
// ONCE (SLICE 1; SLICE 2 controller consumes it, installs its key, then the hub resets the box password).
// Auth = the customer's API key (same credential as config-pull); the token's customer must match the
// path. The value is returned once then marked consumed — a second call 404s. NEVER logged.
func (h *Handler) handleOffsiteConsumePassword(w http.ResponseWriter, r *http.Request, customerID string) {
	authCustomerID, isGlobal, ok := h.checkAuthCustomer(r)
	if !ok || (!isGlobal && authCustomerID != customerID) {
		http.Error(w, "unauthorized", http.StatusUnauthorized)
		return
	}
	pw, err := h.store.ConsumeOneTimeSecret(customerID)
	if err == sql.ErrNoRows {
		http.Error(w, "no unconsumed offsite password", http.StatusNotFound)
		return
	}
	if err != nil {
		h.logger.Printf("[ERROR] offsite consume-password %s: %v", customerID, err) // no secret
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	w.Header().Set("Content-Type", "application/json")
	_ = json.NewEncoder(w).Encode(map[string]string{"password": pw}) // one-time; never logged
}