#!/usr/bin/env nu
# SecretumVault Plugin Quick Demo

print ""
print "═════════════════════════════════════════════════════════════════════════════════"
print "SecretumVault PQC Plugin Demo"
print "═════════════════════════════════════════════════════════════════════════════════"
print ""

# Test 1: Health Check
print "Test 1: Health Check"
try {
    let health = (curl -s -H "X-Vault-Token: mytoken" "http://localhost:8200/v1/sys/health" | from json)
    print "  Status: OK"
    print $"  Sealed: ($health.data.sealed)"
} catch {
    print "  ERROR: Cannot connect to vault"
    exit 1
}

print ""
print "Test 2: Generate ML-KEM-768 Key"
with-env {SECRETUMVAULT_TOKEN: "mytoken"} {
    let key_id = "demo-" + (date now | format date "%s")
    let generated = ("" | secretumvault generate-pqc-key --key-id $key_id)

    let pub_key_size = ($generated.public_key | decode base64 | bytes length)
    print $"  Key ID: ($generated.key_id)"
    print $"  Algorithm: ($generated.algorithm)"
    print $"  Public key size: ($pub_key_size) bytes"

    $key_id | save -f /tmp/pqc-key.txt
}

print ""
print "Test 3: Retrieve Key via API"
with-env {SECRETUMVAULT_TOKEN: "mytoken"} {
    let key_id = (open /tmp/pqc-key.txt)
    let url = "http://localhost:8200/v1/transit/keys/" + $key_id
    let api_resp = (curl -s -H "X-Vault-Token: mytoken" $url | from json)

    if ($api_resp.status == "success") {
        let pub_key_size = ($api_resp.data.public_key | decode base64 | bytes length)
        print $"  Algorithm: ($api_resp.data.algorithm)"
        print $"  Public key size: ($pub_key_size) bytes"
    }
}

print ""
print "Test 4: KEM Encapsulation"
with-env {SECRETUMVAULT_TOKEN: "mytoken"} {
    let key_id = (open /tmp/pqc-key.txt)
    let kem = ("" | secretumvault kem-encapsulate --pqc-key-id $key_id)
    print $"  Algorithm: ($kem.algorithm)"
    print "  Status: Encapsulation OK"
}

print ""
print "Test 5: Plugin Version"
with-env {SECRETUMVAULT_TOKEN: "mytoken"} {
    let version = ("" | secretumvault version)
    print $"  Version: ($version)"
}

print ""
print "═════════════════════════════════════════════════════════════════════════════════"
print ""
print "SUCCESS: All tests passed!"
print ""
print "PQC Commands:"
print "  • generate-pqc-key"
print "  • hybrid-encrypt, hybrid-decrypt"
print "  • hybrid-sign, hybrid-verify"
print "  • kem-encapsulate, kem-decapsulate"
print ""
print "Classical Commands:"
print "  • encrypt, decrypt"
print "  • generate-key, generate-data-key"
print "  • rotate-key"
print ""
print "Environment: SECRETUMVAULT_TOKEN required"
print ""