#!/usr/bin/env python3
"""One-time provisioning of the Fleet Ops demo client identity. Idempotent.

Run this once before minting any demo tokens with mint_demo_token.py.
Connects to the real Hub database using the same HUB_DATABASE_* environment
variables and secret file the dataplane router itself uses.
"""

from __future__ import annotations

import argparse
import sys


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument(
        "--database-url",
        default=None,
        help="Full SQLAlchemy database URL, e.g. postgresql+psycopg://user:pass@host:5432/db. "
        "Overrides HUB_DATABASE_* environment variables and the default /run/secrets password "
        "file -- use this when running outside a container that has that secret mounted.",
    )
    args = parser.parse_args()

    from services.control_api.persistence.db import (
        create_engine_from_url,
        session_factory,
    )
    from services.control_api.persistence.demo_client import provision_demo_client
    from services.runtime.common import hub_database_url

    engine = create_engine_from_url(args.database_url or hub_database_url())
    try:
        sessions = session_factory(engine)
        with sessions() as session, session.begin():
            # Project/environment are deliberately NOT exposed as CLI flags:
            # the demo identity's scope is fixed at mobilityops/prod by
            # provision_demo_client's own defaults and must never be widened
            # from the command line.
            result = provision_demo_client(session)
    finally:
        engine.dispose()
    print(f"demo client id: {result.client_id}")
    print(f"binding id: {result.binding_id}")
    return 0


if __name__ == "__main__":
    sys.exit(main())