// Synthetic test-only signer with the producer's published nonproduction seed.
package main

import (
	"bytes"
	"crypto/ed25519"
	"encoding/json"
	"github.com/netkingdom/access-engine/internal/sign"
	"io"
	"os"
)

func main() {
	seed := byte(0x42)
	kid := "testdata-ed25519"
	if len(os.Args) > 1 {
		seed = 0x43
		kid = "next-admitted"
	}
	raw, err := io.ReadAll(os.Stdin)
	if err != nil {
		os.Exit(1)
	}
	env, err := sign.DecodeEnvelope(raw)
	if err != nil {
		os.Exit(1)
	}
	if sign.Sign(&env, ed25519.NewKeyFromSeed(bytes.Repeat([]byte{seed}, 32)), kid) != nil {
		os.Exit(1)
	}
	json.NewEncoder(os.Stdout).Encode(env)
}