"""Connection helper for the CMMC USB check-in/out database.

Credentials are pulled from app config (env-backed, see Config.CMMC_USB_DB_*),
never hardcoded. Used by the USB plugin to track device check-in/out against a
separate MySQL database (cmmc_usb), mirroring the read-only employee-directory
pattern in employee_db.py. Unlike the employee DB this one is read-write, so
callers commit their own writes and close the connection in a finally block.
"""

import pymysql
from flask import current_app


def _setting_or_config(setting_key, config_key):
    """Non-secret config: a saved Setting wins, else the env-backed app config.

    Lets the setup wizard edit host/name/user without touching .env, while the
    password stays env-only.
    """
    from shopdb.core.models import Setting
    try:
        row = Setting.query.filter_by(key=setting_key).first()
        if row and row.value:
            return row.value
    except Exception:
        pass
    return current_app.config[config_key]


def cmmc_usb_connection():
    """Open a pymysql connection to the cmmc_usb DB."""
    return pymysql.connect(
        host=_setting_or_config('cmmc_usb_db_host', 'CMMC_USB_DB_HOST'),
        user=_setting_or_config('cmmc_usb_db_user', 'CMMC_USB_DB_USER'),
        password=current_app.config['CMMC_USB_DB_PASSWORD'],
        database=_setting_or_config('cmmc_usb_db_name', 'CMMC_USB_DB_NAME'),
        cursorclass=pymysql.cursors.DictCursor,
    )