#!/usr/bin/python3
# Copyright (c) 2026 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# version 2 as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
"""
This script will accept some parameters and will print out some config. data
for use in openidc.{{env}}.static
"""
import base64
import json
import os
import time
import uuid

import click


secret = base64.urlsafe_b64encode(os.urandom(64))[:64].decode()


template = """
Paste this into ansible/roles/ipsilon/templates/openidc.{{env}}.static.j2

--------START CUTTING HERE--------
{service_name} client_id=null
{service_name} client_secret="{{{service_name}_oidc_client_secret}}"
{service_name} client_name="{service_name}"
{service_name} redirect_uris=["https://{service_name}.fedoraproject.org/oidc/callback"]
{service_name} application_type="native"
{service_name} client_uri="http://localhost:13747/"
{service_name} contacts=["admin@fedoraproject.org"]
# This is sometimes client_secret_basic
{service_name} token_endpoint_auth_method="{authmethod}"
{service_name} logo_uri=null
{service_name} policy_uri="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
{service_name} tos_uri=null
{service_name} jwks_uri=null
{service_name} jwks=null
{service_name} sector_identifier_uri=null
{service_name} subject_type="public"
{service_name} response_types="code"
{service_name} grant_types="authorization_code"
{service_name} request_uris=[]
{service_name} require_auth_time=null
{service_name} id_token_signed_response_alg="RS256"
{service_name} request_object_signing_alg="none"
{service_name} initiate_login_uri=null
{service_name} default_max_age=null
{service_name} default_acr_values=null
{service_name} client_secret_expires_at=0
{service_name} ipsilon_internal={{"type":"static","client_id":"{service_name}","trusted":false}}
-------- END CUTTING HERE --------

"""


@click.command()
@click.argument('service_name')
@click.option('--username', '-u', default=None,
              help='The username associated with the token. Defaults to SERVICE_NAME@service.')
@click.option('--authmethod', default="client_secret_post",
              help='The auth_method value, usually client_secret_post / client_secret_basic')
def main(service_name, username, authmethod):
    """
    Print out config. to allow a token to be used by Ipsilon database

    SERVICE_NAME is the name of the service that the token will be used by, (e.g., bodhi).
    """
    username = username or "{}@service".format(service_name)

    meths = ('client_secret_basic', 'client_secret_post', 'none')
    if authmethod not in meths:
        print(" Warning: --authmethod is usually one of:", ", ".join(meths))

    print(template.format(service_name=service_name, username=username,
                          authmethod=authmethod))


if __name__ == '__main__':
    main()