#!/usr/bin/env python3
# #region FullFlow.Environment [C:3] [TYPE Module] [SEMANTICS docker,secrets,isolated-fixture]
# @PURPOSE Generate isolated fixture credentials without reading production settings.
# @PRE Target does not exist; parent directory is writable.
# @POST A mode-0600 env file contains fresh secrets; stdout contains its path only.
# @INVARIANT Existing credentials are never overwritten.
import base64
import os
from pathlib import Path
import secrets
import sys

path = Path(sys.argv[1] if len(sys.argv) > 1 else '/tmp/ss-tools-full-flow.env')
values = {
    'COMPOSE_PROJECT_NAME': 'ss-tools-full-flow',
    'POSTGRES_PASSWORD': secrets.token_hex(24),
    'AUTH_SECRET_KEY': secrets.token_hex(32),
    'ENCRYPTION_KEY': base64.urlsafe_b64encode(secrets.token_bytes(32)).decode(),
    'SERVICE_JWT': secrets.token_hex(32),
    'SUPERSET_SECRET_KEY': secrets.token_hex(32),
    'FIXTURE_PASSWORD': secrets.token_hex(20),
}
with os.fdopen(os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), 'w') as file:
    file.write(''.join(f'{key}={value}\n' for key, value in values.items()))
print(path)
# #endregion FullFlow.Environment