#!/usr/bin/env bash
# Generate RS256 key pair for local MVP JWT (private → demo server, public → interceptor).
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
OUT="${JWT_KEY_DIR:-$ROOT/deployments/docker/jwt}"
mkdir -p "$OUT"

PRIV="$OUT/private.pem"
PUB="$OUT/public.pem"

if [[ -f "$PRIV" && -f "$PUB" ]]; then
  echo "Keys already exist in $OUT (delete to regenerate)."
  exit 0
fi

openssl genrsa -out "$PRIV" 2048
openssl rsa -in "$PRIV" -pubout -out "$PUB"
chmod 600 "$PRIV"

echo "Generated:"
echo "  Private (demo / issuer): $PRIV"
echo "  Public  (interceptor):   $PUB"
echo ""
echo "Interceptor env:"
echo "  JWT_ENABLED=true"
echo "  JWT_REQUIRED=true"
echo "  JWT_ISSUER=acp-dev"
echo "  JWT_AUDIENCE=acp-interceptor"
echo "  JWT_PUBLIC_KEY_PATH=/jwt/public.pem"
echo ""
echo "Agent demo env:"
echo "  JWT_PRIVATE_KEY_PATH=$PRIV"
echo "  JWT_ISSUER=acp-dev"
echo "  JWT_AUDIENCE=acp-interceptor"
