#!/usr/bin/env python3
"""Generate a lab Ed25519 key and a signed secure-messaging.json.

Usage:
  python3 scripts/sign_config.py --out examples/secure-messaging.signed.json
Private key is written to keys/config.ed25519.pem (gitignored).
"""

from __future__ import annotations

import argparse
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "python"))

from secure_messaging.admin_history import AdminHistory
from secure_messaging.signed_config import generate_signing_key, pem_private, pem_public, save_signed, sign


DEFAULT_PAYLOAD = {
    "crypto": {"mode": "lab-xor", "system_key_id": "lab-system"},
    "routing": {"mode": "passthrough"},
    "admin": {"history_cube": "admin-history"},
    "logging": {"mode": "summary"},
}


def main() -> None:
    p = argparse.ArgumentParser()
    p.add_argument("--out", default=str(ROOT / "examples" / "secure-messaging.signed.json"))
    p.add_argument("--actor", default="lab-admin")
    args = p.parse_args()
    keydir = ROOT / "keys"
    keydir.mkdir(mode=0o700, exist_ok=True)
    priv_path = keydir / "config.ed25519.pem"
    if priv_path.exists():
        from cryptography.hazmat.primitives.serialization import load_pem_private_key

        priv = load_pem_private_key(priv_path.read_bytes(), password=None)
    else:
        priv = generate_signing_key()
        priv_path.write_bytes(pem_private(priv))
        priv_path.chmod(0o600)
        (keydir / "config.ed25519.pub.pem").write_bytes(pem_public(priv.public_key()))
    out = Path(args.out)
    prev = out.read_text() if out.exists() else ""
    signed = sign(DEFAULT_PAYLOAD, priv)
    out.parent.mkdir(parents=True, exist_ok=True)
    save_signed(out, signed)
    hist = AdminHistory(ROOT / "examples" / "admin-history")
    hist.append_change(actor=args.actor, prev_text=prev, new_text=signed.dumps())
    print("wrote", out)
    print("history", hist.path)


if __name__ == "__main__":
    main()