"""
Shared utility for retrieving user passwords from available session sources.

Centralises the 3-source fallback chain (session password store → Flask g →
temp auth store) so every route that needs the current user's DB password
uses the same logic.  Without this, each route reimplemented the chain
independently, risking subtle divergence (e.g. one route forgetting to
check temp_auth, or using a different method alias).
"""

from typing import Optional

from flask import g, session


def get_user_password(username: str) -> Optional[str]:
    """Retrieve user password from available session sources.

    Checks, in order:
    1. SessionPasswordStore (persistent per-session passwords)
    2. Flask ``g.user_password`` (set by middleware when temp_auth was used)
    3. TempAuthStore (one-time tokens stored during login redirect)

    Returns ``None`` when no password can be found — callers must decide
    whether that is acceptable (e.g. non-encrypted databases) or an error
    (encrypted databases → 401).
    """
    from ...database.session_passwords import session_password_store

    session_id = session.get("session_id")
    if session_id:
        password = session_password_store.get_session_password(
            username, session_id
        )
        if password:
            return password

    password = getattr(g, "user_password", None)
    if password:
        return password

    from ...database.temp_auth import temp_auth_store

    auth_token = session.get("temp_auth_token")
    if auth_token:
        auth_data = temp_auth_store.peek_auth(auth_token)
        if auth_data and auth_data[0] == username:
            return auth_data[1]

    return None
