"""
Tier 1 API Demo (The "3-line API")

This example demonstrates the simplified Tier 1 API for protecting tools
and managing authority scopes.

⚠️  IMPORTANT: This demo uses Tier 1 guardrails (no cryptography).
    For production systems, use Tier 2 (Warrant + PoP) to protect against
    insider threats and container compromise. See examples/openai_warrant.py.
"""

import asyncio
from tenuo import (
    configure,
    mint,
    grant,
    guard,
    SigningKey,
    Subpath,
    Capability,
)
from tenuo.schemas import ToolSchema, register_schema

# 1. Configure Tenuo (once at startup)
issuer_key = SigningKey.generate()
configure(issuer_key=issuer_key, dev_mode=True)

# 2. Register schema for critical tools (optional but recommended)
register_schema("delete_file", ToolSchema(recommended_constraints=["path"], risk_level="critical"))


# 3. Define protected tools using @guard
@guard(tool="read_file")
async def read_file(path: str) -> str:
    print(f"  [Tool] Reading file: {path}")
    return "file content"


@guard(tool="delete_file")
async def delete_file(path: str) -> str:
    print(f"  [Tool] Deleting file: {path}")
    return "deleted"


async def main():
    print("--- Tier 1 API Demo ---")

    # 4. Use mint to define initial scope
    print("\n1. Root Task: Allow reading /data/")
    async with mint(Capability("read_file", path=Subpath("/data"))):
        # Authorized call
        await read_file(path="/data/report.txt")

        # Unauthorized call (wrong path)
        try:
            print("  [Attempt] Reading /etc/passwd...")
            await read_file(path="/etc/passwd")
        except Exception as e:
            print(f"  [Blocked] {e}")

    # 5. Scoped Task: Narrowing authority
    print("\n2. Scoped Task: Narrowing to /data/reports/")
    async with mint(Capability("read_file", path=Subpath("/data"))):
        # Create a narrower scope
        async with grant(Capability("read_file", path=Subpath("/data/reports"))):
            # Authorized in narrow scope
            await read_file(path="/data/reports/q3.pdf")

            # Unauthorized in narrow scope (but allowed in parent)
            try:
                print("  [Attempt] Reading /data/other.txt...")
                await read_file(path="/data/other.txt")
            except Exception as e:
                print(f"  [Blocked] {e}")

    # 6. Critical Tool Protection
    print("\n3. Critical Tool: delete_file")
    try:
        # Try to use critical tool without constraints
        async with mint(Capability("delete_file")):
            print("  [Attempt] Deleting /data/file.txt...")
            await delete_file(path="/data/file.txt")
    except Exception as e:
        print(f"  [Blocked] {e}")


if __name__ == "__main__":
    asyncio.run(main())
