#!/usr/bin/env nu
def main [
    --workspace: string = ""
    --key-type: string = ""
    --new-pubkey-path: string = ""
    --dry-run
]: nothing -> nothing {
    let ws          = if ($workspace       | is-not-empty) { $workspace }       else { $env.PLAYBOOK_PARAM_WORKSPACE?       | default "" }
    let ktype       = if ($key_type        | is-not-empty) { $key_type }        else { $env.PLAYBOOK_PARAM_KEY_TYPE?        | default "" }
    let pubkey_path = if ($new_pubkey_path | is-not-empty) { $new_pubkey_path } else { $env.PLAYBOOK_PARAM_NEW_PUBKEY_PATH? | default "" }

    if ($ws | is-empty) { error make { msg: "workspace is required" } }
    if ($ktype | is-empty) { error make { msg: "key-type is required" } }

    let repo = $"state-($ws)"
    let pubkey_content = if ($pubkey_path | is-not-empty) and ($pubkey_path | path exists) {
        open $pubkey_path | str trim
    } else { "" }

    if $dry_run {
        print $"[dry-run] would propose ($ktype) delegation patch on Radicle repo ($repo)"
        print $"[dry-run] new pubkey: ($pubkey_content | str substring 0..60)..."
        return
    }

    let patch_content = {
        type: "delegation-patch",
        key_type: $ktype,
        workspace: $ws,
        new_pubkey: $pubkey_content,
        timestamp: (date now | format date "%Y-%m-%dT%H:%M:%SZ"),
        action: "rotate",
    } | to json

    let patch_file = $"/tmp/delegation-patch-($ws)-($ktype).json"
    $patch_content | save --force $patch_file

    let rad_r = do { ^rad patch create --repo $repo --message $"Rotate ($ktype) key for workspace ($ws)" --attach $patch_file } | complete
    if $rad_r.exit_code != 0 {
        error make { msg: $"rad patch create failed: ($rad_r.stderr | str trim)" }
    }

    rm --force $patch_file
    print $"delegation patch proposed on ($repo)"
    print $rad_r.stdout
}