#!/usr/bin/env python3
"""Create a new external AES-256 keyring without printing key material."""

from __future__ import annotations

import argparse
import base64
import json
import os
from pathlib import Path


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--path", default="/var/www/html/.platform-secrets/secrets-keyring.json")
    parser.add_argument("--version", default="key-2026-01")
    args = parser.parse_args()
    path = Path(args.path)
    if path.exists():
        print(json.dumps({"status": "exists", "path": str(path)}))
        return 0
    path.parent.mkdir(mode=0o750, parents=True, exist_ok=True)
    payload = {
        "active_version": args.version,
        "keys": {
            args.version: base64.urlsafe_b64encode(os.urandom(32)).decode("ascii"),
        },
    }
    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o640)
    with os.fdopen(descriptor, "w", encoding="utf-8") as stream:
        json.dump(payload, stream)
        stream.write("\n")
    print(json.dumps({"status": "created", "path": str(path), "active_version": args.version}))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())