"""Scope-aware secret reads for the iris plugin.

Shared by ``adapter.py`` (token / TLS / FCM credentials) and ``setup.py``
(config probes + env enablement).
"""

import os

from agent.secret_scope import UnscopedSecretError as _UnscopedSecretError
from agent.secret_scope import get_secret as _scoped_get_secret


def _get_scoped_secret(name, default=None):
    """Scope-aware credential read with the default-profile startup fallback.

    Secondary profiles construct their adapters under a profile secret scope
    -- the scope is authoritative and a scoped miss returns ``default`` (no
    cross-profile borrow from ``os.environ``, which may hold another
    profile's value). The DEFAULT profile's adapter constructs and sends
    *unscoped* under multiplexing, where a bare ``get_secret`` would raise
    ``UnscopedSecretError`` and crash this path; there ``os.environ`` is that
    profile's own value, so fall back to it. Same pattern as the IRC
    ``IRC_SERVER_PASSWORD`` read (``plugins/platforms/irc/adapter.py``).
    """
    try:
        val = _scoped_get_secret(name, default)
    except _UnscopedSecretError:
        val = os.getenv(name)
    return val if val is not None else default