"""nova idp setup --check/--apply/--verify (REQ-340, REQ-341, C-2.1, ≤50 lines)."""

from __future__ import annotations

import importlib.util
import json
import sys
from pathlib import Path


def _load_setup():
    """Load core/lambda/nova_idp_setup.py via importlib (`lambda` is reserved)."""
    p = Path(__import__("core").__file__).parent / "lambda" / "nova_idp_setup.py"
    spec = importlib.util.spec_from_file_location("nova_idp_setup", p)
    mod = importlib.util.module_from_spec(spec); spec.loader.exec_module(mod)
    return mod


def add_parser(subparsers):
    p = subparsers.add_parser("setup", help="check/apply/verify the Nova IdP stack")
    p.add_argument("--check", action="store_true", help="check prerequisites")
    p.add_argument("--apply", action="store_true", help="generate + deploy (NFR-10 y/N)")
    p.add_argument("--verify", action="store_true", help="run the KMS round-trip test")
    p.add_argument("--dry-run", action="store_true", help="resource summary only")
    p.add_argument("--public-jwks-domain", default=None, help="custom JWKS domain")
    p.set_defaults(_run=run)


def run(args) -> int:
    mod = _load_setup()
    if args.check:
        print(json.dumps(mod.check_prerequisites(), indent=2)); return 0
    if args.verify:
        r = mod.verify(); print(json.dumps(r, indent=2)); return 0 if r["passed"] else 1
    if args.apply or args.dry_run:
        r = mod.generate_and_deploy(args.public_jwks_domain, dry_run=args.dry_run)
        print(json.dumps(r["summary"], indent=2))
        return 0 if (r["deployed"] or args.dry_run) else 1
    print("usage: nova idp setup --check|--apply|--verify [--dry-run]", file=sys.stderr)
    return 2