"""Connection helper for the read-only employee directory database.

Credentials are pulled from app config (env-backed, see Config.EMPLOYEE_DB_*),
never hardcoded. Used by the employee lookup API and the notification
recognition feature.
"""

import pymysql
from flask import current_app


def _setting_or_config(setting_key, config_key):
    """Non-secret config: a saved Setting wins, else the env-backed app config.

    Lets the setup wizard edit host/name/user without touching .env, while the
    password stays env-only.
    """
    from shopdb.core.models import Setting
    try:
        row = Setting.query.filter_by(key=setting_key).first()
        if row and row.value:
            return row.value
    except Exception:
        pass
    return current_app.config[config_key]


def employee_connection():
    """Open a pymysql connection to the employee directory DB."""
    return pymysql.connect(
        host=_setting_or_config('employee_db_host', 'EMPLOYEE_DB_HOST'),
        user=_setting_or_config('employee_db_user', 'EMPLOYEE_DB_USER'),
        password=current_app.config['EMPLOYEE_DB_PASSWORD'],
        database=_setting_or_config('employee_db_name', 'EMPLOYEE_DB_NAME'),
        cursorclass=pymysql.cursors.DictCursor,
    )