package store

import (
	bolt "go.etcd.io/bbolt"
)

// credential holds a user's password hash, kept in its own bucket so it
// never travels with a store.User value (see the comment on User).
type credential struct {
	PasswordHash string `json:"password_hash"`
}

func (s *Store) SetPasswordHash(username, hash string) error {
	return s.db.Update(func(tx *bolt.Tx) error {
		if tx.Bucket(bucketUsers).Get([]byte(username)) == nil {
			return ErrNotFound
		}
		return putJSON(tx, bucketAuth, username, credential{PasswordHash: hash})
	})
}

func (s *Store) GetPasswordHash(username string) (string, error) {
	var c credential
	err := s.db.View(func(tx *bolt.Tx) error {
		return getJSON(tx, bucketAuth, username, &c)
	})
	return c.PasswordHash, err
}

func (s *Store) DeletePasswordHash(username string) error {
	return s.db.Update(func(tx *bolt.Tx) error {
		return deleteKey(tx, bucketAuth, username)
	})
}