#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Location: ./mcpgateway/utils/hash_password.py
Copyright 2026
SPDX-License-Identifier: Apache-2.0

Generate Argon2id password hashes for emergency admin recovery operations.
"""

# Standard
import argparse
import asyncio
import getpass
import sys

# First-Party
from mcpgateway.services.argon2_service import Argon2PasswordService


async def _generate_hash(password: str) -> str:
    """Generate an Argon2id hash for a plaintext password.

    Args:
        password: Plaintext password.

    Returns:
        str: Argon2id encoded hash.
    """
    service = Argon2PasswordService()
    return await service.hash_password_async(password)


def main() -> int:
    """Run CLI entrypoint for generating password hashes.

    Returns:
        int: Process exit code (`0` success, non-zero on validation failure).
    """
    parser = argparse.ArgumentParser(description="Generate an Argon2id password hash for MCP Gateway users.")
    parser.add_argument("--password", help="Password value. If omitted, a secure prompt is used.")
    args = parser.parse_args()

    password = args.password
    if not password:
        password = getpass.getpass("Password: ")
        confirm = getpass.getpass("Confirm password: ")
        if password != confirm:
            print("Passwords do not match.", file=sys.stderr)
            return 1

    if not password:
        print("Password cannot be empty.", file=sys.stderr)
        return 1

    password_hash = asyncio.run(_generate_hash(password))
    print(password_hash)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())
