#!/usr/bin/env python3
"""Generate a random CTRADER_TOKEN_SECRET for the cTrader token vault.

Usage:
    python dev_generate_keys.py          # Generate a fresh secret, add to .env
    python dev_generate_keys.py --show   # Show existing secret from .env

The same secret is used to encrypt tokens on the forwarder and decrypt them
in external scripts (e.g. scripts/ctrader_refresh.py). Keep it safe.
"""

from __future__ import annotations

import argparse
import secrets
from pathlib import Path


def generate_secret(length: int = 64) -> str:
    """Return a high-entropy url-safe secret string."""
    return secrets.token_urlsafe(length)


def update_env_file(env_path: Path, secret: str) -> None:
    """Insert or replace CTRADER_TOKEN_SECRET in .env."""
    if env_path.exists():
        lines = env_path.read_text("utf-8").splitlines()
    else:
        lines = []

    new_lines: list[str] = []
    seen = False

    for line in lines:
        if line.startswith("CTRADER_TOKEN_SECRET="):
            new_lines.append(f"CTRADER_TOKEN_SECRET={secret}")
            seen = True
            continue
        new_lines.append(line)

    if not seen:
        new_lines.append(f"CTRADER_TOKEN_SECRET={secret}")

    env_path.write_text("\n".join(new_lines) + "\n", "utf-8")
    print(f"✅ Updated {env_path}")
    print(f"   CTRADER_TOKEN_SECRET = {secret[:16]}...")
    print("\n⚠️  Keep this secret out of version control. "
          "Anyone with it can decrypt stored cTrader tokens.")


def show_secret(env_path: Path) -> None:
    """Print the current CTRADER_TOKEN_SECRET from .env."""
    if not env_path.exists():
        raise SystemExit(f"No .env found at {env_path}")
    for line in env_path.read_text("utf-8").splitlines():
        if line.startswith("CTRADER_TOKEN_SECRET="):
            print(line.split("=", 1)[1])
            return
    raise SystemExit("CTRADER_TOKEN_SECRET not found in .env")


def main(argv: list[str] | None = None) -> int:
    parser = argparse.ArgumentParser(
        description="Generate CTRADER_TOKEN_SECRET for cTrader encrypted token vault"
    )
    parser.add_argument(
        "--env", default=".env", help="Path to .env file (default: .env)"
    )
    parser.add_argument(
        "--show", action="store_true", help="Show existing secret and exit"
    )
    args = parser.parse_args(argv)

    env_path = Path(args.env)

    if args.show:
        show_secret(env_path)
        return 0

    print("Generating random CTRADER_TOKEN_SECRET …")
    secret = generate_secret()
    update_env_file(env_path, secret)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())