#!/usr/bin/env python3
"""Provision one real Authentik service account as a project-bound MCP client."""

from __future__ import annotations

import argparse
import json
import os
import sys
from pathlib import Path
from uuid import UUID

_ROOT_DIR = Path(__file__).resolve().parents[1]
if str(_ROOT_DIR) not in sys.path:
    sys.path.insert(0, str(_ROOT_DIR))


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--subject", required=True, help="Exact validated Authentik token subject")
    parser.add_argument("--oauth-username", required=True)
    parser.add_argument("--name", required=True)
    parser.add_argument("--project", required=True)
    parser.add_argument("--environment", default="prod")
    parser.add_argument("--issuer", default=os.environ.get("HUB_OIDC_ISSUER"))
    parser.add_argument("--public-host", default="mcp.example.com")
    parser.add_argument("--database-url", default=None)
    parser.add_argument(
        "--client-id",
        type=UUID,
        default=None,
        help="Optional pending Hub client ID created by the management UI.",
    )
    args = parser.parse_args()
    if not args.issuer:
        parser.error("--issuer or HUB_OIDC_ISSUER is required")

    from services.control_api.persistence.db import create_engine_from_url, session_factory
    from services.control_api.persistence.machine_client import provision_machine_client
    from services.runtime.common import hub_database_url

    engine = create_engine_from_url(args.database_url or hub_database_url())
    try:
        sessions = session_factory(engine)
        with sessions() as session, session.begin():
            result = provision_machine_client(
                session,
                issuer=args.issuer,
                subject=args.subject,
                oauth_username=args.oauth_username,
                name=args.name,
                project_slug=args.project,
                environment_name=args.environment,
                public_host=args.public_host,
                client_id=args.client_id,
            )
    finally:
        engine.dispose()
    print(
        json.dumps(
            {
                "clientId": str(result.client_id),
                "bindingId": str(result.binding_id),
                "endpoint": result.endpoint,
                "oauthUsername": args.oauth_username,
            },
            sort_keys=True,
        )
    )
    return 0


if __name__ == "__main__":
    raise SystemExit(main())