// Creates or renews the kiosk certificates without starting the server.
//   node scripts/make-cert.mjs           renew the server certificate if needed
//   node scripts/make-cert.mjs --force   new certificate authority as well
import { ensureCertificates, describe } from '../src/tls.js';

const force = process.argv.includes('--force');

try {
  ensureCertificates({ force });
  const info = describe();
  console.log('');
  console.log('Certificate authority :', info.caPath);
  console.log('  fingerprint         :', info.ca?.fingerprint);
  console.log('  expires             :', info.ca?.validTo, `(${info.ca?.daysLeft} days)`);
  console.log('Server certificate    :', info.server?.validTo, `(${info.server?.daysLeft} days)`);
  console.log('  valid for           :', (info.server?.names || []).join(', '));
  console.log('');
  console.log('Install the authority certificate on each kiosk device, then restart the container.');
} catch (err) {
  console.error('Could not create certificates:', err.message);
  process.exit(1);
}