package config

import (
	"errors"
	"strings"
)

// normalizeLegacySecretData hands the decrypted WinAuth SecretData string
// off to the modern Entry.SecretRaw slot. The modern authenticator
// SetSecretData methods already accept the exact C# WinAuth on-disk form
// (tab-separated head with pipe-separated trailers), so the conversion
// is mostly a sanity check.
//
// vendor is the value detectLegacyVendor produced and is used only to
// catch obviously empty/malformed payloads early; the per-vendor parse
// happens later in authenticator.SetSecretData.
func normalizeLegacySecretData(vendor, secret string) (string, error) {
	secret = strings.TrimSpace(secret)
	if secret == "" {
		return "", errors.New("legacy entry: empty secret payload")
	}
	switch vendor {
	case "battlenet":
		// Either "<hex>\t...|<serialhex>" (modern C# form) or the
		// legacy WinAuth2 short form "<40 hex secret><utf8-hex serial>".
		// Both are accepted by BattleNetAuthenticator.SetSecretData.
		return secret, nil
	case "steam":
		// "<hex>\t...|serial|device|steamdata|session" — SetSecretData
		// also tolerates fewer fields.
		return secret, nil
	default:
		return secret, nil
	}
}