"""Secret-file helpers that never include secret values in errors or reprs."""

from pathlib import Path


class SecretFileError(RuntimeError):
    """Raised when a configured secret file cannot be read safely."""


def read_secret_file(path: Path) -> str:
    """Read one Docker/Kubernetes secret without exposing its content."""

    try:
        if not path.is_file():
            raise SecretFileError(f"Secret file is missing or not a file: {path}")
        value = path.read_text(encoding="utf-8").strip()
    except OSError as exc:
        raise SecretFileError(f"Secret file cannot be read: {path}") from exc

    if not value:
        raise SecretFileError(f"Secret file is empty: {path}")
    if "\n" in value or "\r" in value:
        raise SecretFileError(f"Secret file must contain exactly one logical line: {path}")
    return value