#!/usr/bin/env node
'use strict';

/**
 * 生成 JWT 用 Ed25519 密钥对（PEM）。
 * 用法：node scripts/generate-jwt-keys.js [--force]
 * 输出目录默认：apps/server/keys/（已 gitignore）
 */
const fs = require('fs');
const path = require('path');
const { generateKeyPairSync } = require('crypto');
const { DEFAULT_DIR, DEFAULT_PRIVATE, DEFAULT_PUBLIC } = require('../src/auth/jwt-keys');

const force = process.argv.includes('--force');

function main() {
  if (!force && (fs.existsSync(DEFAULT_PRIVATE) || fs.existsSync(DEFAULT_PUBLIC))) {
    console.error('密钥已存在。若要覆盖请加 --force');
    console.error(`  private: ${DEFAULT_PRIVATE}`);
    console.error(`  public:  ${DEFAULT_PUBLIC}`);
    process.exit(1);
  }

  fs.mkdirSync(DEFAULT_DIR, { recursive: true, mode: 0o700 });
  const { privateKey, publicKey } = generateKeyPairSync('ed25519');
  const privPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
  const pubPem = publicKey.export({ type: 'spki', format: 'pem' });

  fs.writeFileSync(DEFAULT_PRIVATE, privPem, { mode: 0o600 });
  fs.writeFileSync(DEFAULT_PUBLIC, pubPem, { mode: 0o644 });

  console.log('已生成 Ed25519 JWT 密钥对：');
  console.log(`  private: ${DEFAULT_PRIVATE} (mode 600)`);
  console.log(`  public:  ${DEFAULT_PUBLIC}`);
  console.log('可选 .env：');
  console.log(`  JWT_PRIVATE_KEY_PATH=${DEFAULT_PRIVATE}`);
  console.log(`  JWT_PUBLIC_KEY_PATH=${DEFAULT_PUBLIC}`);
  console.log('  JWT_KEY_ID=ed25519-1');
}

main();