package vault

import (
	"context"

	"github.com/hashicorp/vault/api"
)

// Service is the single entry point the UI and headless CLI use for all
// Vault data-plane operations. It exists so callers never touch *api.Client
// or KV directly — this is the dependency boundary internal/ui relies on to
// stay free of the hashicorp/vault/api import.
type Service struct {
	Client   *api.Client
	KV       *KV
	ReadOnly bool
}

// New wires a Service around an already-authenticated client. readOnly is
// enforced here (via KV.ReadOnly), not just in the UI's disabled
// keybindings — this is the boundary that actually blocks writes.
func New(c *api.Client, readOnly bool) *Service {
	return &Service{
		Client:   c,
		KV:       &KV{Client: c, ReadOnly: readOnly},
		ReadOnly: readOnly,
	}
}

func (s *Service) Mounts(ctx context.Context) ([]Mount, error) {
	return ListMounts(ctx, s.Client)
}