#!/usr/bin/env python3
"""
manage_keys.py — CLI for managing Status Checker API keys.

Usage:
    python3 scripts/manage_keys.py generate <label>
    python3 scripts/manage_keys.py revoke <label>
    python3 scripts/manage_keys.py list
    python3 scripts/manage_keys.py rotate <label>

Run this from the project folder (local dev) or on the server (production —
it reads/writes the same keystore the proxy uses: /etc/status-checker/api_keys.json
by default, override with STATUS_CHECKER_KEYSTORE).
"""

import argparse
import sys
import os

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
import apikeys  # noqa: E402


def cmd_generate(args):
    raw_key = apikeys.generate_key(args.label)
    print(f"\nGenerated key for '{args.label}':\n")
    print(f"    {raw_key}\n")
    print("This is shown ONCE — store it in a password manager / secrets vault now.")
    print("Give it to the team member, or set it as the AI agent's X-Api-Key header.")
    print("It cannot be retrieved again later, only revoked and reissued.\n")


def cmd_revoke(args):
    matched = apikeys.revoke_key(args.label)
    if matched:
        print(f"Revoked {len(matched)} key(s) with label '{args.label}'.")
    else:
        print(f"No active key found with label '{args.label}'.")


def cmd_list(args):
    keys = apikeys.list_keys()
    if not keys:
        print("No keys have been generated yet.")
        return
    print(f"{'LABEL':<24} {'STATUS':<10} {'CREATED':<22} {'LAST USED':<22} {'USES'}")
    for k in keys:
        status = "revoked" if k["revoked"] else "active"
        print(f"{k['label']:<24} {status:<10} {k['created']:<22} {str(k['last_used']):<22} {k['use_count']}")


def cmd_rotate(args):
    matched = apikeys.revoke_key(args.label)
    raw_key = apikeys.generate_key(args.label)
    if matched:
        print(f"Revoked old key(s) for '{args.label}'.")
    print(f"\nNew key for '{args.label}':\n")
    print(f"    {raw_key}\n")
    print("Update this everywhere the old key was configured (team member, AI agent config, etc).\n")


def main():
    parser = argparse.ArgumentParser(description="Manage Status Checker API keys")
    sub = parser.add_subparsers(dest="command", required=True)

    p_gen = sub.add_parser("generate", help="Create a new API key")
    p_gen.add_argument("label", help="Human-readable label, e.g. 'jordan-support' or 'ai-agent-whatsapp'")
    p_gen.set_defaults(func=cmd_generate)

    p_rev = sub.add_parser("revoke", help="Revoke an existing key by label")
    p_rev.add_argument("label")
    p_rev.set_defaults(func=cmd_revoke)

    p_list = sub.add_parser("list", help="List all keys and their status")
    p_list.set_defaults(func=cmd_list)

    p_rot = sub.add_parser("rotate", help="Revoke a key and issue a new one under the same label")
    p_rot.add_argument("label")
    p_rot.set_defaults(func=cmd_rotate)

    args = parser.parse_args()
    args.func(args)


if __name__ == "__main__":
    main()