#!/usr/bin/env python3
"""Create a Pulsar-compatible HS256 JWT for Terraform's external provider."""

import base64
import hashlib
import hmac
import json
import sys


def b64url(value: bytes) -> str:
    return base64.urlsafe_b64encode(value).decode("ascii").rstrip("=")


def main() -> int:
    request = json.load(sys.stdin)
    subject = request["subject"]
    secret = base64.b64decode(request["secret"], validate=True)
    if len(secret) < 32:
        raise ValueError("Pulsar token secret must contain at least 32 bytes")

    header = b64url(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode())
    payload = b64url(json.dumps({"sub": subject}, separators=(",", ":")).encode())
    signing_input = f"{header}.{payload}".encode()
    signature = b64url(hmac.new(secret, signing_input, hashlib.sha256).digest())
    json.dump({"token": f"{header}.{payload}.{signature}"}, sys.stdout)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())