"""Build a MailProvider from an account row (SPEC §10.2 decryption boundary).

This module runs only inside the worker/sync context; ``decrypt_secret`` (the
credential vault) is invoked here to obtain the plaintext mailbox password. It
must never be imported by API request code.

A native account (the user's hosted mailbox, App. D §D.4) has no stored
password: the worker signs in as itself, acting for the user.
"""

from __future__ import annotations

from app.models import Account
from app.providers.imap_smtp import ImapSmtpProvider, ProviderConfig
from app.security.crypto import decrypt_secret


def build_provider(account: Account) -> ImapSmtpProvider:
    """Construct an :class:`ImapSmtpProvider` for ``account`` (password auth, M0)."""
    if account.kind == "native":
        from app.hosted.native import native_provider_config

        return ImapSmtpProvider(native_provider_config(account.email))
    imap = account.imap_config
    smtp = account.smtp_config
    password = decrypt_secret(account.secret_ct).decode("utf-8")
    config = ProviderConfig(
        imap_host=str(imap["host"]),
        imap_port=int(str(imap["port"])),
        imap_tls=str(imap.get("tls", "ssl")),
        smtp_host=str(smtp["host"]),
        smtp_port=int(str(smtp["port"])),
        smtp_tls=str(smtp.get("tls", "ssl")),
        username=account.email,
        password=password,
    )
    return ImapSmtpProvider(config)