"""
Key management blueprint — unified view of all key material.
"""

from auth import get_username, login_required
from flask import Blueprint, flash, redirect, render_template, url_for

from soosef.audit import log_action

bp = Blueprint("keys", __name__, url_prefix="/keys")


@bp.route("/")
@login_required
def index():
    """Key management dashboard."""
    from soosef.keystore import KeystoreManager

    ks = KeystoreManager()
    return render_template("fieldkit/keys.html", keystore=ks.status())


@bp.route("/channel/generate", methods=["POST"])
@login_required
def generate_channel():
    """Generate a new channel key."""
    from soosef.keystore import KeystoreManager

    ks = KeystoreManager()
    try:
        key = ks.generate_channel_key()
        log_action(
            actor=get_username(),
            action="key.channel.generate",
            target=f"channel:{key[:8]}",
            outcome="success",
            source="web",
        )
        flash(f"Channel key generated: {key[:8]}...", "success")
    except Exception as exc:
        log_action(
            actor=get_username(),
            action="key.channel.generate",
            target="channel",
            outcome="failure",
            source="web",
            detail=str(exc),
        )
        flash(f"Channel key generation failed: {exc}", "error")
    return redirect(url_for("keys.index"))


@bp.route("/identity/generate", methods=["POST"])
@login_required
def generate_identity():
    """Generate a new Ed25519 identity."""
    from soosef.keystore import KeystoreManager

    ks = KeystoreManager()
    try:
        info = ks.generate_identity()
        log_action(
            actor=get_username(),
            action="key.identity.generate",
            target=f"identity:{info.fingerprint[:16]}",
            outcome="success",
            source="web",
        )
        flash(f"Identity generated: {info.fingerprint[:16]}...", "success")
    except Exception as exc:
        log_action(
            actor=get_username(),
            action="key.identity.generate",
            target="identity",
            outcome="failure",
            source="web",
            detail=str(exc),
        )
        flash(f"Identity generation failed: {exc}", "error")
    return redirect(url_for("keys.index"))