#!/usr/bin/env python3
"""Create the external Ed25519 App Pack signing keypair."""

from __future__ import annotations

import json
import os
from pathlib import Path

from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey


PRIVATE_PATH = Path("/var/www/html/.platform-signing/wordpress-app-pack-ed25519.pem")
PUBLIC_PATH = Path("/var/www/html/.platform-signing/wordpress-app-pack-ed25519.pub.pem")


def main() -> int:
    if PRIVATE_PATH.exists() or PUBLIC_PATH.exists():
        print(json.dumps({"status": "exists", "private_path": str(PRIVATE_PATH), "public_path": str(PUBLIC_PATH)}))
        return 0
    PRIVATE_PATH.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
    key = Ed25519PrivateKey.generate()
    private_bytes = key.private_bytes(
        serialization.Encoding.PEM,
        serialization.PrivateFormat.PKCS8,
        serialization.NoEncryption(),
    )
    public_bytes = key.public_key().public_bytes(
        serialization.Encoding.PEM,
        serialization.PublicFormat.SubjectPublicKeyInfo,
    )
    private_fd = os.open(PRIVATE_PATH, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
    with os.fdopen(private_fd, "wb") as stream:
        stream.write(private_bytes)
    public_fd = os.open(PUBLIC_PATH, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)
    with os.fdopen(public_fd, "wb") as stream:
        stream.write(public_bytes)
    print(json.dumps({"status": "created", "private_path": str(PRIVATE_PATH), "public_path": str(PUBLIC_PATH)}))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())