"""Shared Diffbot credential resolution for both the library and the CLI.

The same lookup chain is used everywhere so a single credential works for the
``db`` CLI and any Python script that constructs a client:

1. An explicit token passed to the client / function.
2. The ``DIFFBOT_API_TOKEN`` environment variable.
3. A ``DIFFBOT_API_TOKEN=...`` line in ``~/.diffbot/credentials``.
"""

import os
import pathlib
from typing import Optional

TOKEN_ENV_VAR = "DIFFBOT_API_TOKEN"
CREDENTIALS_PATH = pathlib.Path.home() / ".diffbot" / "credentials"


def _read_credentials_file() -> str:
    if not CREDENTIALS_PATH.exists():
        return ""
    for line in CREDENTIALS_PATH.read_text().splitlines():
        line = line.strip()
        if line.startswith(f"{TOKEN_ENV_VAR}="):
            return line[len(TOKEN_ENV_VAR) + 1:].strip()
    return ""


def resolve_token(token: Optional[str] = None) -> str:
    """Resolve a Diffbot API token from the explicit argument, env var, or file.

    Returns an empty string if no token can be found.
    """
    if token and token.strip():
        return token.strip()

    env_token = os.environ.get(TOKEN_ENV_VAR, "").strip()
    if env_token:
        return env_token

    return _read_credentials_file()