// Substrate KeyManager — SPIRE KeyManager plugin.
//
// Runs in SPIRE Server. Manages signing keys with governance-aware rotation.
// Key rotation events require ceremony approval when the Accord policy demands it,
// ensuring that CA key changes are governed mutations.
package main

import (
	"context"
	"log"

	"github.com/hashicorp/go-plugin"
	"google.golang.org/grpc"
)

var handshakeConfig = plugin.HandshakeConfig{
	ProtocolVersion:  1,
	MagicCookieKey:   "ServerAgent",
	MagicCookieValue: "GuildhouseSpire",
}

// SubstrateKeyManagerPlugin implements plugin.GRPCPlugin for the key manager.
type SubstrateKeyManagerPlugin struct {
	plugin.Plugin
	Impl *SubstrateKeyManager
}

func (p *SubstrateKeyManagerPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
	log.Println("substrate-keymanager: gRPC server registered")
	return nil
}

func (p *SubstrateKeyManagerPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
	return nil, nil
}

func main() {
	km := &SubstrateKeyManager{}

	plugin.Serve(&plugin.ServeConfig{
		HandshakeConfig: handshakeConfig,
		Plugins: map[string]plugin.Plugin{
			"key_manager": &SubstrateKeyManagerPlugin{Impl: km},
		},
		GRPCServer: plugin.DefaultGRPCServer,
	})
}