#!/usr/bin/env python3
"""Create a WCAHT QR enrollment using an on-host Ed25519 identity key."""
import argparse, json, subprocess, urllib.error, urllib.parse, urllib.request
from pathlib import Path
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
def b58(raw):
    n=int.from_bytes(raw,"big"); out=""
    while n: n,r=divmod(n,58); out=ALPHABET[r]+out
    return "1"*(len(raw)-len(raw.lstrip(b"\0")))+out
def post(base,path,data):
    req=urllib.request.Request(base+path,json.dumps(data).encode(),{"Content-Type":"application/json","User-Agent":"WCAHT-Enroll/1"})
    try:
        with urllib.request.urlopen(req,timeout=20) as r:return json.loads(r.read())
    except urllib.error.HTTPError as e:raise SystemExit(f"Enrollment failed: HTTP {e.code}: {e.read().decode()[:500]}")
def main():
    p=argparse.ArgumentParser(); p.add_argument("--key",required=True); p.add_argument("--endpoint",required=True); p.add_argument("--dashboard",default="https://dashboard.denvion.com")
    a=p.parse_args(); raw=Path(a.key).read_bytes()
    if len(raw)!=64:raise SystemExit("Key must be a raw 64-byte Ed25519 keypair")
    identity=b58(raw[32:]); created=post(a.dashboard,"/api/validator/enrollment/create",{"node_identity":identity,"endpoint":a.endpoint})
    sig=Ed25519PrivateKey.from_private_bytes(raw[:32]).sign(created["challenge"].encode()).hex()
    proof=post(a.dashboard,"/api/validator/enrollment/node-proof",{"token":created["token"],"signature":sig})
    url=a.dashboard+"/validators/qr?token="+urllib.parse.quote(created["token"])
    print("Node identity:",identity); print("Pairing URL:",url); print("Expires at:",created["expires_at"])
    try: subprocess.run(["qrencode","-t","ANSIUTF8",url],check=False)
    except FileNotFoundError: print("Optional: install qrencode to display this URL as a terminal QR code.")
if __name__=="__main__":main()