"""nova auth revoke --pat <jti> — revoke a PAT (REQ-344, D-229)."""

from __future__ import annotations

import os
import sys

from core.auth_store import emit_revoke_audit


def add_parser(subparsers):
    p = subparsers.add_parser("revoke", help="revoke a PAT by jti")
    p.add_argument("--pat", required=True, help="PAT jti to revoke")
    p.add_argument("--endpoint", default=os.environ.get("NOVA_TOKEN_VEND_URL", ""),
                   help="token-vend function URL (empty = local DDB)")
    p.set_defaults(_run=run)


def _revoke_remote(jti: str, endpoint: str) -> dict:
    import json, urllib.request
    body = json.dumps({"action": "revoke_pat", "jti": jti}).encode()
    req = urllib.request.Request(endpoint, data=body, headers={"Content-Type": "application/json"})
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.loads(r.read())


def run(args) -> int:
    try:
        if args.endpoint and args.endpoint.startswith("http"):
            _revoke_remote(args.pat, args.endpoint)
        else:
            from core.pat_lifecycle import revoke_pat
            revoke_pat(args.pat)
        emit_revoke_audit(args.pat)
        print(f"revoked: jti={args.pat}")
        return 0
    except Exception as e:
        print(f"error: {e}", file=sys.stderr); return 2