package lagoon

import (
	"context"
	"crypto/rand"
	"encoding/base64"

	"git.golem15.com/golem15/summercms/modules/bonfire"
)

// GenerateAppKey returns a fresh app.key: 32 random bytes from crypto/rand,
// base64 (standard encoding) encoded, 44 characters. It is the value
// key:generate prints, without the output decoration.
func GenerateAppKey() (string, error) {
	key := make([]byte, encryptedKeySize)
	if _, err := rand.Read(key); err != nil {
		return "", err
	}
	return base64.StdEncoding.EncodeToString(key), nil
}

// KeyGenerateCommand prints a fresh 32-byte base64 app.key and performs no
// other side effect (D-11). --json prints {"key": "..."}; under -q the bare
// key is printed, because the key is the data the command exists for (D-27).
func KeyGenerateCommand() bonfire.Command {
	return bonfire.Command{
		Name:        "key:generate",
		Description: "Print a fresh 32-byte base64 app.key",
		Long: `Prints a new random app.key (32 bytes, base64) and changes nothing: put it in
SUMMER_APP__KEY or config/app.yaml yourself. app.key encrypts Encrypted
columns and signs sessions, so changing it on a running application makes
existing encrypted values unreadable; move the old key to app.previous_keys
first. With -q only the key is printed; --json prints {"key": "..."}.`,
		Flags: []bonfire.Flag{jsonFlag},
		Examples: []bonfire.Example{
			{Command: "key:generate", Description: "Print a new key"},
			{Command: "key:generate -q", Description: "Print only the key, for scripts: KEY=$(bin/acme key:generate -q)"},
			{Command: "key:generate --json", Description: "Print the key as JSON"},
		},
		Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
			key, err := GenerateAppKey()
			if err != nil {
				return err
			}
			switch {
			case flagOn(in, "json"):
				return printJSON(out, map[string]string{"key": key})
			case bonfire.IsQuiet(out):
				out.Println(key)
			default:
				out.Success(key)
			}
			return nil
		},
	}
}