"""Provision one local service credential; the bearer key is shown only once."""

from __future__ import annotations

import argparse
import os
from pathlib import Path

from gewu.adapters.sqlite_identity import SQLiteIdentityStore


def main() -> None:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--credential-id", required=True)
    parser.add_argument("--principal-id", required=True)
    parser.add_argument(
        "--role", action="append", choices=("admin", "editor", "viewer", "agent"), required=True
    )
    parser.add_argument("--project", action="append", default=[])
    arguments = parser.parse_args()
    data_root = Path(os.environ.get("GEWU_DATA_ROOT", "./.data/gewu")).expanduser().absolute()
    data_root.mkdir(parents=True, exist_ok=True, mode=0o700)
    token = SQLiteIdentityStore(data_root / "identity.sqlite3").provision(
        credential_id=arguments.credential_id,
        principal_id=arguments.principal_id,
        roles=tuple(arguments.role),
        project_ids=tuple(arguments.project),
    )
    print("Store this bearer credential securely; it cannot be displayed again:")
    print(token)


if __name__ == "__main__":
    main()