//! Dev utility: mint a signed session cookie without going through OIDC.
//! Anyone holding SESSION_SECRET can forge sessions anyway; this just makes
//! local API testing possible before an IdP is wired up.
//!
//! Usage: SESSION_SECRET=... cargo run --example mint_session -- <user-uuid> <email>

use cookie::{Cookie, CookieJar, Key};
use sha2::{Digest, Sha512};

fn main() {
    let mut args = std::env::args().skip(1);
    let user_id = args.next().expect("usage: mint_session <user-uuid> <email>");
    // Sessions are only honored for lowercased emails present in ALLOWED_EMAILS.
    let email = args
        .next()
        .expect("usage: mint_session <user-uuid> <email>")
        .to_lowercase();
    let secret = std::env::var("SESSION_SECRET").expect("SESSION_SECRET must be set");
    let key = Key::from(&Sha512::digest(secret.as_bytes()));
    let exp = chrono::Utc::now().timestamp() + 86400;
    let mut jar = CookieJar::new();
    jar.signed_mut(&key).add(Cookie::new(
        "photos_session",
        format!("{user_id}|{exp}|{email}"),
    ));
    // The plain jar now holds the signed on-wire value.
    let cookie = jar.get("photos_session").unwrap();
    println!("photos_session={}", cookie.value());
}