#!/usr/bin/env nu
def main [
    --workspace: string = ""
    --key-type: string = ""
    --dry-run
]: nothing -> nothing {
    let ws    = if ($workspace | is-not-empty) { $workspace } else { $env.PLAYBOOK_PARAM_WORKSPACE? | default "" }
    let ktype = if ($key_type  | is-not-empty) { $key_type }  else { $env.PLAYBOOK_PARAM_KEY_TYPE?  | default "" }

    if ($ws | is-empty) { error make { msg: "workspace is required" } }

    let repo = $"state-($ws)"

    if $dry_run {
        print $"[dry-run] would revoke old ($ktype) key from delegation set in ($repo)"
        return
    }

    let list_r = do { ^rad patch list --repo $repo --state merged --json } | complete
    if $list_r.exit_code != 0 {
        print $"WARNING: cannot list merged patches on ($repo) to confirm old key revoked: ($list_r.stderr | str trim)"
        return
    }

    let patches = $list_r.stdout | from json
    let rotation_patches = $patches | where { |p|
        ($p.title? | default "" | str contains "Rotate") and ($p.title? | default "" | str contains $ktype)
    }

    if ($rotation_patches | is-empty) {
        print $"WARNING: no merged rotation patch found for ($ktype) in ($repo) — old key revocation should be verified manually"
        return
    }

    let patch_id = $rotation_patches | last | get id
    print $"Delegation patch ($patch_id) merged — old ($ktype) key is no longer in delegation set"
    print $"Verify: rad delegate list --repo ($repo) should not contain old pubkey"
}