#!/usr/bin/env python3
"""Mint a short-lived Fleet Ops demo bearer token. Operator-only.

Prints the token and its jti exactly once; nothing is persisted in
plaintext anywhere. Run provision_demo_client.py once, first, before the
first token is ever minted, and reachable via the same secret file
(DEMO_TOKEN_KEY_FILE, default /run/secrets/demo_token_signing_key) the
dataplane router verifies against.
"""

from __future__ import annotations

import argparse
import sys
from pathlib import Path

from services.runtime.demo_token import (
    MAX_TTL_HOURS,
    MIN_TTL_HOURS,
    load_demo_token_signing_key,
    mint_demo_token,
)


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument(
        "--label", required=True, help="Human-readable name for this link, e.g. an org or event."
    )
    parser.add_argument(
        "--ttl-hours",
        type=int,
        default=48,
        help=f"Token lifetime in hours ({MIN_TTL_HOURS}-{MAX_TTL_HOURS}, default 48).",
    )
    parser.add_argument(
        "--mcp-base-url",
        default="https://mcp.example.com",
        help="Base URL demo users should connect their MCP client to.",
    )
    parser.add_argument(
        "--key-file",
        type=Path,
        default=None,
        help="Path to the demo token signing secret file. Defaults to DEMO_TOKEN_KEY_FILE / "
        "/run/secrets/demo_token_signing_key (container context). Pass this explicitly when "
        "running on the Tower host directly, e.g. "
        "/srv/example/appdata/itworx-mcp-hub/secrets/demo_token_signing_key.",
    )
    args = parser.parse_args()

    key = load_demo_token_signing_key(args.key_file)
    token, jti = mint_demo_token(key, ttl_hours=args.ttl_hours)

    print(f"label: {args.label}")
    print(f"jti: {jti}  (save this -- needed to revoke early)")
    print(f"expires in: {args.ttl_hours}h")
    print()
    print("MCP client connection:")
    print(f"  URL:          {args.mcp_base_url}/mcp/mobilityops/prod")
    print(f"  Bearer token: {token}")
    return 0


if __name__ == "__main__":
    sys.exit(main())