#!/usr/bin/env python3
"""
Descope management key operations via the Descope SDK.

Usage:
    python test_mgmt_key.py --project-id <id> --management-key <key> [--base-url <url>]
"""

import argparse
import json
import sys

from descope import (
    DescopeClient,
    MgmtKeyProjectRole,
    MgmtKeyReBac,
    MgmtKeyStatus,
    MgmtKeyTagRole,
)


def _print_json(obj):
    print(json.dumps(obj, indent=2, default=str))


def main():
    parser = argparse.ArgumentParser(
        description="Descope management key operations",
    )
    parser.add_argument("--project-id", required=True)
    parser.add_argument("--management-key", required=True)
    parser.add_argument("--base-url", default=None)
    args = parser.parse_args()

    client_kwargs = {
        "project_id": args.project_id,
        "management_key": args.management_key,
    }
    if args.base_url:
        client_kwargs["base_url"] = args.base_url

    client_kwargs["verbose"] = True
    descope_client = DescopeClient(**client_kwargs)

    # Search all management keys
    print("=== Search all management keys ===")
    search_resp = descope_client.mgmt.management_key.search()
    keys = search_resp["keys"]
    for key in keys:
        _print_json(key)
        print()

    print(f"PRJ: {args.project_id}")
    # Create a new management key with RBAC configuration
    print("=== Create a new management key ===")
    rebac = MgmtKeyReBac(
        company_roles=["company-full-access"],
        project_roles=[],
        tag_roles=[],
    )

    create_resp = descope_client.mgmt.management_key.create(
        name="My Management Key",
        rebac=rebac,
        description="Optional description for the management key",
        expires_in=0,
        permitted_ips=[],
    )
    key = create_resp["key"]
    cleartext = create_resp["cleartext"]
    print("Created key:")
    _print_json(key)
    print(f"Cleartext (save securely, will not be shown again): {cleartext}")

    key_id = key["id"]

    # Load a specific management key by ID
    print(f"\n=== Load management key {key_id} ===")
    load_resp = descope_client.mgmt.management_key.load(key_id)
    loaded_key = load_resp["key"]
    _print_json(loaded_key)

    # Update the management key
    print(f"\n=== Update management key {key_id} ===")
    update_resp = descope_client.mgmt.management_key.update(
        id=key_id,
        name="Updated Key Name",
        description="Updated description",
        permitted_ips=["10.0.0.2"],
        status=MgmtKeyStatus.ACTIVE,
    )
    updated_key = update_resp["key"]
    print("Updated key:")
    _print_json(updated_key)

    # Delete the management key
    print(f"\n=== Delete management key {key_id} ===")
    delete_resp = descope_client.mgmt.management_key.delete([key_id])
    total_deleted = delete_resp["total"]
    print(f"Deleted {total_deleted} key(s).")


if __name__ == "__main__":
    main()