// codeberg.org/mapleopentech/monorepo/cloud/maplefile-backend/internal/usecase/tag/create.go
package tag

import (
	"context"
	"fmt"

	dom_tag "codeberg.org/mapleopentech/monorepo/cloud/maplefile-backend/internal/domain/tag"
)

type CreateTagUseCase struct {
	tagRepo dom_tag.Repository
}

func NewCreateTagUseCase(tagRepo dom_tag.Repository) *CreateTagUseCase {
	return &CreateTagUseCase{
		tagRepo: tagRepo,
	}
}

// Execute creates a new tag with encrypted data (E2EE)
// The client is responsible for:
// 1. Generating a random tag key
// 2. Encrypting name and color with the tag key
// 3. Encrypting the tag key with the user's master key
// 4. Sending all encrypted data to the backend
func (uc *CreateTagUseCase) Execute(ctx context.Context, tag *dom_tag.Tag) error {
	// Validate encrypted data is present
	if tag.EncryptedName == "" {
		return fmt.Errorf("encrypted tag name is required")
	}
	if tag.EncryptedColor == "" {
		return fmt.Errorf("encrypted tag color is required")
	}
	if tag.EncryptedTagKey == nil || len(tag.EncryptedTagKey.Ciphertext) == 0 {
		return fmt.Errorf("encrypted tag key is required")
	}
	if tag.State == "" {
		return fmt.Errorf("tag state is required")
	}

	// Backend never sees plaintext - only validates encrypted data exists
	if err := uc.tagRepo.Create(ctx, tag); err != nil {
		return fmt.Errorf("failed to create tag: %w", err)
	}

	return nil
}
