"""This module defines the protect CLI commands for encrypting Python wheel files."""

from pathlib import Path
from typing import Annotated

import typer

from voraus_pipeline_utils.methods.protect import protect_wheel_wrapper

app = typer.Typer(name="protect")


@app.command("wheel")
def _cli_protect_wheel(  # noqa: PLR0913
    *,
    wheel_file: Annotated[
        Path,
        typer.Argument(
            help="Path to the wheel file to protect.",
        ),
    ],
    identifier: Annotated[
        str,
        typer.Option(help="The protection identifier"),
    ],
    replace: Annotated[
        bool,
        typer.Option(help="Whether to replace the original wheel or create a new file."),
    ] = True,
    api_endpoint: Annotated[
        str,
        typer.Option(help="The protector API endpoint.", envvar="PROTECTOR_API_ENDPOINT"),
    ] = "https://protector.vorausrobotik.com",
    access_key_id: Annotated[
        str,
        typer.Option(help="Access key ID for authentication.", envvar="PROTECTOR_ACCESS_KEY_ID", hide_input=True),
    ],
    access_secret_key: Annotated[
        str,
        typer.Option(
            help="Access secret key for authentication.", envvar="PROTECTOR_ACCESS_SECRET_KEY", hide_input=True
        ),
    ],
) -> None:
    r"""Encrypt Python wheel files using the voraus-software-protector service.

    This feature enables secure distribution of protected Python packages in CI/CD pipelines.
    The command encrypts wheel files via REST API. Credentials can be provided via environment
    variables or CLI options.

    Environment Variables:
    - PROTECTOR_ACCESS_KEY_ID: Access key ID for authentication
    - PROTECTOR_ACCESS_SECRET_KEY: Access secret key for authentication
    - PROTECTOR_API_ENDPOINT: API endpoint URL (optional, defaults to https://protector.vorausrobotik.com)

    Examples:
    Basic usage with environment variables::

        export PROTECTOR_ACCESS_KEY_ID="your-key-id"
        export PROTECTOR_ACCESS_SECRET_KEY="your-secret-key"
        vpu protect wheel dist/my_package-1.0.0-py3-none-any.whl --identifier=my-package-1

    Using explicit credentials::

        vpu protect wheel dist/my_package-1.0.0-py3-none-any.whl \\
            --identifier=my-package-1 \\
            --access-key-id=your-key-id \\
            --access-secret-key=your-secret-key

    Create encrypted copy without replacing original::

        vpu protect wheel dist/my_package-1.0.0-py3-none-any.whl \\
            --identifier=my-package-1 \\
            --no-replace

    Jenkins Pipeline Example::

        pipeline {
            agent any
            stages {
                stage('Protect Wheel') {
                    steps {
                        withCredentials([
                            usernamePassword(
                                credentialsId: 'protector-credentials',
                                usernameVariable: 'PROTECTOR_ACCESS_KEY_ID',
                                passwordVariable: 'PROTECTOR_ACCESS_SECRET_KEY'
                            )
                        ]) {
                            sh '''
                                vpu protect wheel dist/*.whl --identifier=my-package-1
                            '''
                        }
                    }
                }
            }
        }

    GitHub Actions Example::

        - name: Protect wheel
          env:
            PROTECTOR_ACCESS_KEY_ID: ${{ secrets.PROTECTOR_ACCESS_KEY_ID }}
            PROTECTOR_ACCESS_SECRET_KEY: ${{ secrets.PROTECTOR_ACCESS_SECRET_KEY }}
          run: |
            vpu protect wheel dist/*.whl --identifier=my-package-1

    """
    protect_wheel_wrapper(
        wheel_file=wheel_file,
        identifier=identifier,
        api_endpoint=api_endpoint,
        access_key_id=access_key_id,
        access_secret_key=access_secret_key,
        replace=replace,
    )
