"""
Generate a VAPID keypair for Web Push notifications.

Uses `cryptography` directly rather than py_vapid's own Vapid02.generate_keys(),
which raises `TypeError: curve must be an EllipticCurve instance` against
newer versions of `cryptography` (confirmed with cryptography 46.0.3 / py-vapid 1.9.2).
"""

import base64

from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import serialization
from django.core.management.base import BaseCommand


class Command(BaseCommand):
    help = 'Generate a VAPID public/private keypair for Web Push notifications'

    def handle(self, *args, **options):
        private_key = ec.generate_private_key(ec.SECP256R1())
        public_key = private_key.public_key()

        private_value = private_key.private_numbers().private_value
        private_bytes = private_value.to_bytes(32, 'big')
        private_b64 = base64.urlsafe_b64encode(private_bytes).rstrip(b'=').decode()

        public_bytes = public_key.public_bytes(
            encoding=serialization.Encoding.X962,
            format=serialization.PublicFormat.UncompressedPoint,
        )
        public_b64 = base64.urlsafe_b64encode(public_bytes).rstrip(b'=').decode()

        self.stdout.write('Add these to your environment configuration:\n')
        self.stdout.write(f'VAPID_PUBLIC_KEY={public_b64}')
        self.stdout.write(f'VAPID_PRIVATE_KEY={private_b64}')
        self.stdout.write('VAPID_ADMIN_EMAIL=<your admin contact email>')