"""patchbay-web entry point.

  python3 -m patchbay_web [-c conf] [serve]          run the HTTPS web UI
  python3 -m patchbay_web [-c conf] hashpw           print a password hash
  python3 -m patchbay_web [-c conf] add-client NAME  add a client key read from stdin
"""

import argparse
import getpass
import ssl
import sys

from . import create_app, daemon, db, security, tls, validate


def main():
    ap = argparse.ArgumentParser(prog="patchbay-web")
    ap.add_argument("-c", "--config", default="/etc/patchbay/patchbay.conf")
    sub = ap.add_subparsers(dest="cmd")
    sub.add_parser("serve")
    sub.add_parser("hashpw")
    ac = sub.add_parser("add-client")
    ac.add_argument("name")
    args = ap.parse_args()

    if args.cmd == "hashpw":
        pw = getpass.getpass("Password: ")
        print(security.hash_password(pw))
        return 0

    app = create_app(args.config)
    conf = app.config["PB_CONF"]

    if args.cmd == "add-client":
        try:
            name = validate.name(args.name, "client name")
            key = validate.pubkey(sys.stdin.read())
        except validate.Invalid as e:
            print(f"error: {e}", file=sys.stderr)
            return 1
        with app.app_context():
            db.get().execute("INSERT INTO clients (name, pubkey, added_by, created) VALUES (?, ?, 'cli', ?)",
                             (name, key, db.now()))
            print(daemon.reload())
        return 0

    cert, key = conf.get("tlscert"), conf.get("tlskey")
    if tls.ensure_cert(cert, key):
        print(f"generated self-signed certificate {cert}", file=sys.stderr)
    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    ctx.minimum_version = ssl.TLSVersion.TLSv1_2
    ctx.load_cert_chain(cert, key)

    from werkzeug.serving import run_simple
    run_simple(conf.get("webbind"), conf.getint("webport", 8443), app, ssl_context=ctx, threaded=True)
    return 0


if __name__ == "__main__":
    sys.exit(main())