1import { randomUrlSafeBytes } from "../../sharedF/randomBytesF.mts"
2import { secretForBkt } from '../../serverF/secretsF/secretForBktF.mts'
3import { genJsonSecretIfMissing } from "../secretF/genSecretAI.mts"
4
5// secrets hold creds/endpoints only — bucket→cluster placement lives in code (bktPlacementH),
6// not here: genJsonSecretIfMissing is write-once, so secret-carried topology silently goes stale.
7export const genBktSecret = async ({bucket_name, endpoint, autoYes, useAwsv4Sig}: {bucket_name: string, endpoint: string, autoYes?: boolean, useAwsv4Sig?: boolean}) => {
8  const secretName = secretForBkt(bucket_name)
9  await genJsonSecretIfMissing({
10    secretName,
11    autoYes,
12    genValue: () => ({
13      accessKeyId: bucket_name,
14      secretAccessKey: randomUrlSafeBytes(32),
15      endpoint,
16      s3ForcePathStyle: true,
17      ...(useAwsv4Sig && {useAwsv4Sig}),
18    })
19  })
20}