"""Password prompt rules for connection configs."""

from __future__ import annotations

from sqlit.domains.connections.domain.config import ConnectionConfig
from sqlit.domains.connections.providers.metadata import is_file_based, requires_auth


def needs_db_password(config: ConnectionConfig) -> bool:
    """Return True if the database password should be prompted."""
    if is_file_based(config.db_type):
        return False

    if not requires_auth(config.db_type):
        return False

    auth_type = config.get_option("auth_type")
    if auth_type in ("ad_default", "ad_integrated", "windows"):
        return False

    endpoint = config.tcp_endpoint
    if not endpoint or endpoint.password is not None:
        return False
    if endpoint.password_command:
        return False
    return True


def needs_ssh_password(config: ConnectionConfig) -> bool:
    """Return True if the SSH password should be prompted."""
    if not config.tunnel or not config.tunnel.enabled:
        return False

    if config.tunnel.auth_type != "password":
        return False

    if config.tunnel.password is not None:
        return False
    if config.tunnel.password_command:
        return False
    return True
