use clap::{Args, Subcommand};
use std::path::PathBuf;

use super::ksu::KsuRevokeReason;

/// AUTO-GENERATED BY Kam/scripts/add_missing_docs.py: placeholder documentation for public struct 'SecretArgs'. Replace with real documentation. (2025-12-30T22:23:21Z)
#[derive(Args, Debug)]
pub struct SecretArgs {
    /// Interactive mode: guide the user through secret management (add/list/get/remove, etc.)
    #[arg(short = 'i', long = "interactive")]
    pub interactive: bool,

    #[command(subcommand)]
    /// AUTO-GENERATED BY Kam/scripts/add_missing_docs.py: placeholder documentation for public field 'command' in 'SecretArgs'. Replace with real documentation. (2025-12-30T22:23:21Z)
    pub command: Option<SecretCommands>,
}

/// AUTO-GENERATED BY Kam/scripts/add_missing_docs.py: placeholder documentation for public enum 'SecretCommands'. Replace with real documentation. (2025-12-30T22:23:21Z)
#[derive(Subcommand, Debug)]
pub enum SecretCommands {
    /// List saved secrets
    List,

    /// Add a secret from a value or file
    Add {
        /// Name of the secret
        name: String,

        /// Path to a file to read the secret from
        #[arg(short, long)]
        file: Option<PathBuf>,

        /// Also accept path as a second positional parameter so users can run `kam secret add name path`
        #[arg(value_name = "FILE")]
        file_path: Option<PathBuf>,

        /// Provide value directly
        #[arg(short, long)]
        value: Option<String>,

        /// Force storing to local file instead of system keyring
        #[arg(long, default_value_t = false)]
        force_file: bool,
        /// Pass the password on the CLI (not recommended); password will be prompted if not set
        #[arg(long)]
        password: Option<String>,
        /// Also create a local fallback file under ~/.kam/secrets
        #[arg(long, default_value_t = false)]
        with_backup: bool,
    },

    /// Get a secret and print it to stdout (or --out file)
    Get {
        /// Name of the secret
        name: String,

        /// Write to file instead of stdout
        #[arg(short, long)]
        out: Option<PathBuf>,

        /// Pass the password on the CLI (not recommended). If not provided, will ask interactively
        #[arg(long)]
        password: Option<String>,
    },

    /// Remove a secret
    Remove {
        /// Name of the secret
        name: String,
    },
    /// Export secret to a file (by default decrypted). Use --encrypted to export encrypted blob.
    Export {
        /// Name of the secret to export
        name: String,
        /// Destination path to write the exported secret
        path: PathBuf,
        /// Export as encrypted blob instead of plain (default: false)
        #[arg(long, default_value_t = false)]
        encrypted: bool,
    },

    /// Import secret from a file. If file is an encrypted KAM blob, it will be stored as-is.
    Import {
        /// Source file path to import from
        path: PathBuf,
        /// Optional name to use when storing the imported secret
        #[arg(long)]
        name: Option<String>,
    },

    /// Export public key from a stored private key secret
    ExportPub {
        /// Name of the secret
        #[arg(default_value = "main")]
        name: String,

        /// Output file path (if omitted, prints to stdout)
        #[arg(short, long)]
        out: Option<PathBuf>,
    },

    /// Import developer certificate chain from GitHub issue or file
    ImportCert {
        /// GitHub repository (format: owner/repo, e.g., "kernelsu/developers")
        #[arg(long)]
        repo: Option<String>,

        /// GitHub issue number containing the certificate
        #[arg(long)]
        issue: Option<u32>,

        /// Path to certificate chain PEM file
        #[arg(long)]
        cert_chain: Option<PathBuf>,

        /// Name to store certificate under
        name: String,
    },

    /// Manage trusted Root CAs
    Trust {
        /// Add Root CA from file or URL
        #[arg(long)]
        add_root: Option<String>,

        /// Name for the Root CA
        #[arg(long)]
        ca_name: Option<String>,

        /// List trusted Root CAs
        #[arg(long)]
        list: bool,

        /// Remove Root CA by name
        #[arg(long)]
        remove: Option<String>,
    },

    /// Generate a KernelSU developer P-256 key pair for developers.kernelsu.org
    KsuGenerate {
        /// Key name used for output filenames
        #[arg(long, default_value = "kernelsu-developer")]
        name: String,

        /// Output directory for generated key files
        #[arg(short, long, default_value = ".")]
        out: PathBuf,

        /// Do not use gpg even when it is available
        #[arg(long)]
        no_gpg: bool,

        /// Overwrite existing output files
        #[arg(short, long)]
        force: bool,
    },

    /// Create the KernelSU developer public-key submission issue URL
    KsuSubmit {
        /// GitHub username to submit
        #[arg(long)]
        username: String,

        /// Public key PEM generated by `kam secret ksu-generate`
        #[arg(long)]
        public_key: PathBuf,

        /// Open the generated GitHub issue form in a browser
        #[arg(long)]
        open: bool,
    },

    /// Create the KernelSU developer certificate revocation issue URL
    KsuRevoke {
        /// GitHub username that owns the certificate
        #[arg(long)]
        username: String,

        /// Certificate serial number. If omitted, pass --cert to extract it.
        #[arg(long)]
        serial_number: Option<String>,

        /// Certificate PEM file to extract the serial number from
        #[arg(long)]
        cert: Option<PathBuf>,

        /// Revocation reason accepted by the KernelSU issue form
        #[arg(long, value_enum)]
        reason: KsuRevokeReason,

        /// Additional revocation details
        #[arg(long, default_value = "")]
        details: String,

        /// Open the generated GitHub issue form in a browser
        #[arg(long)]
        open: bool,
    },
}
