"""Runtime configuration helpers that keep secret values out of manifests."""

from __future__ import annotations

import os
from pathlib import Path


def database_target(default: str | Path | None = None) -> str | Path:
    """Return the configured database target, preferring a mounted secret file."""
    url_file = os.getenv("SBOM_NEXUS_DATABASE_URL_FILE")
    if url_file:
        path = Path(url_file)
        try:
            value = path.read_text(encoding="utf-8").strip()
        except OSError as exc:
            raise RuntimeError(f"Unable to read SBOM_NEXUS_DATABASE_URL_FILE: {path}") from exc
        if not value:
            raise RuntimeError(f"SBOM_NEXUS_DATABASE_URL_FILE is empty: {path}")
        return value

    url = os.getenv("SBOM_NEXUS_DATABASE_URL")
    if url:
        return url

    path = os.getenv("SBOM_NEXUS_DATABASE_PATH")
    if path:
        return path

    if default is None:
        raise RuntimeError(
            "Configure SBOM_NEXUS_DATABASE_URL_FILE, SBOM_NEXUS_DATABASE_URL, "
            "or SBOM_NEXUS_DATABASE_PATH"
        )
    return default