from __future__ import annotations
import hvac


def create_hvac_client(*, url: str, token: str, timeout: int = 5) -> hvac.Client:
    client = hvac.Client(url=url, token=token, timeout=timeout)
    if not client.is_authenticated():
        raise RuntimeError("Vault authentication failed. Check VAULT_ADDR / VAULT_TOKEN")
    return client


def read_kv2_secret(*, client: hvac.Client, mount_point: str, path: str) -> dict:
    secret = client.secrets.kv.v2.read_secret_version(
        mount_point=mount_point,
        path=path,
    )
    return secret["data"]["data"]