"""
Demo using jwtauth.testing utilities to generate a bearer token
with MFA support.

python -mvenv env

./env/bin/pip3 install "secrets-manager>=1.4.6" -i https://pypi.theorchard.io/
./env/bin/pip3 install pytest
./env/bin/pip3 install "jwtauth[testing]==0.6.0rc1" -i https://pypi.theorchard.io/

To run:
    # Update the .env values
    cp .env.shadow .env

    # run the command
    ./env/bin/python3 jwtauth_mfa_demo.py \
        --email="pdptest+mfa@theorchard.com" \
        --password="<password>" \
        --otp-secret-key="otp-secret-key"
"""

import argparse
from environs import Env

from jwtauth.testing.schemas import Auth0Creds, UserCreds
from jwtauth.testing.utils import generate_bearer_jwt_token
from pydantic import SecretStr


def read_env():
    """Read environment variables from .env file."""
    env = Env()
    env.read_env()

    return {
        "CLIENT_ID": env.str("CLIENT_ID"),
        "CLIENT_SECRET": env.str("CLIENT_SECRET"),
    }


def parse_args():
    """Parse command line arguments."""
    parser = argparse.ArgumentParser(
        description="Generate bearer JWT token with MFA support using jwtauth testing utilities"
    )
    parser.add_argument("--email", required=True, help="User email address")
    parser.add_argument("--password", required=True, help="User password")
    parser.add_argument("--otp-secret-key", required=True, help="OTP secret key for MFA")
    return parser.parse_args()


def main():
    """Main function to parse arguments and generate bearer token."""
    # Load environment variables
    env_vars = read_env()

    # Parse command line arguments
    args = parse_args()

    # Create Auth0Creds using environment variables
    auth0_creds = Auth0Creds(
        auth0_client_id=env_vars["CLIENT_ID"],
        auth0_client_secret=env_vars["CLIENT_SECRET"],
    )

    # Create UserCreds using command line arguments
    user_creds = UserCreds(
        email=args.email,
        password=SecretStr(args.password),
        otp_secret_key=args.otp_secret_key,
    )

    # Generate bearer token using jwtauth testing utility
    # This handles both regular auth and MFA automatically
    token = generate_bearer_jwt_token(user_creds=user_creds, auth0_creds=auth0_creds)

    print(f"Bearer token: {token[:10]}...")


if __name__ == "__main__":
    main()