#!/usr/bin/env python3
"""Generate a fresh private AES-GCM credentials bundle locally; never run via web."""
import argparse, base64, json, secrets
from pathlib import Path
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
p=argparse.ArgumentParser()
p.add_argument('--db-host', default='localhost')
p.add_argument('--db-name', default='axenapis_api')
p.add_argument('--db-user', default='axenapis_api')
p.add_argument('--db-password', required=True)
p.add_argument('--out', default='axenapi-private')
a=p.parse_args();dest=Path(a.out);dest.mkdir(parents=True, exist_ok=True)
key=secrets.token_bytes(32);iv=secrets.token_bytes(12)
raw=json.dumps(dict(host=a.db_host,name=a.db_name,user=a.db_user,password=a.db_password)).encode()
enc=AESGCM(key).encrypt(iv, raw, None)
(dest/'runtime.key.php').write_text("<?php\nreturn '"+base64.b64encode(key).decode()+"';\n")
(dest/'credentials.enc.php').write_text("<?php\nreturn [\n"+''.join("    '%s' => '%s',\n"%(k,base64.b64encode(v).decode()) for k,v in [('iv',iv),('tag',enc[-16:]),('ciphertext',enc[:-16])])+'];\n')
print('Private configuration generated in',dest,'— move outside public_html')