#!/usr/bin/env python3
"""Standalone consumer: fetch encrypted cTrader tokens from the forwarder and decrypt.

Usage::

    python scripts/ctrader_consumer.py [--env .env] [--output tokens.json]

Environment variables read from .env (or pass explicitly):
    CTRADER_API_BASE    — Forwarder URL, default https://quill.nx.kg/f
    WEB_PIN             — Dashboard PIN
    CTRADER_TOKEN_SECRET — Shared secret used to decrypt tokens
"""

from __future__ import annotations

import argparse
import json
from pathlib import Path

from common import load_env, ForwarderClient


def _load_secret(env: dict[str, str]) -> str:
    """Return the CTRADER_TOKEN_SECRET from env or raise."""
    secret = env.get("CTRADER_TOKEN_SECRET", "")
    if not secret:
        raise SystemExit(
            "CTRADER_TOKEN_SECRET not found in .env. "
            "Generate one with: python dev_generate_keys.py"
        )
    return secret


def main(argv: list[str] | None = None) -> int:
    parser = argparse.ArgumentParser(description="Fetch and decrypt cTrader tokens")
    parser.add_argument("--env", default=".env", help="Path to .env file")
    parser.add_argument("--output", "-o", default="", help="Write decrypted tokens to JSON file")
    args = parser.parse_args(argv)

    env = load_env(Path(args.env))
    base_url = env.get("CTRADER_API_BASE", "https://quill.nx.kg/f")
    pin = env.get("WEB_PIN", "")
    if not pin:
        raise SystemExit("WEB_PIN not found in .env")

    secret = _load_secret(env)

    print(f"Connecting to {base_url} …")
    client = ForwarderClient(base_url, pin)
    accounts = client.list_accounts(encrypted=True)
    print(f"Received {len(accounts)} account(s)\n")

    from crypto_vault import decrypt_payload

    results: list[dict] = []
    for acct in accounts:
        meta = {k: v for k, v in acct.items() if k != "encrypted_payload"}
        enc = acct.get("encrypted_payload")
        if not enc:
            print(f"  [!] Account {acct.get('account_id')} — no encrypted payload")
            continue
        try:
            payload = decrypt_payload(secret, enc)
            meta["decrypted"] = {
                k: (v[:24] + "…" if isinstance(v, str) and k.endswith("_token") else v)
                for k, v in payload.items()
            }
            meta["_tokens"] = payload
            print(
                f"  ✓ Account {acct.get('account_id')} — "
                f"broker={acct.get('broker_title') or acct.get('broker_name')} "
                f"live={acct.get('is_live')} "
                f"access={payload.get('access_token', '')[:24]}… "
                f"expires={payload.get('expires_at', 0):.0f}"
            )
            results.append(meta)
        except Exception as exc:
            print(f"  [X] Account {acct.get('account_id')} decrypt failed: {exc}")

    if args.output:
        output_path = Path(args.output)
        save_data = [
            {"account": {k: v for k, v in r.items() if k != "_tokens"}, "tokens": r.get("_tokens")}
            for r in results
        ]
        output_path.write_text(json.dumps(save_data, indent=2, default=str), "utf-8")
        print(f"\nWrote decrypted tokens to {output_path}")

    return 0


if __name__ == "__main__":
    raise SystemExit(main())