"""Minimal example: create a token, check what the agent can and can't do."""

from apoa import (
    APOA,
    Agent,
    generate_key_pair,
)


def main() -> None:
    private_key, public_key = generate_key_pair()
    apoa = APOA(private_key=private_key)

    token = apoa.tokens.create_grant(
        principal="did:apoa:alex",
        agent=Agent(id="did:apoa:docs-assistant", name="Docs Assistant"),
        service="knowledge-base",
        scopes=["articles:search", "articles:summarize"],
        constraints={"external_sharing": False},
        expires_in="24h",
    )

    validation = apoa.tokens.validate(token.raw, public_key=public_key)
    print("token valid ->", validation.valid)

    # Can the agent summarize articles? Yes.
    allowed = apoa.authorizations.check(token, "knowledge-base", "articles:summarize")
    print("articles:summarize ->", allowed)

    # Can the agent delete articles? Absolutely not.
    denied = apoa.authorizations.check(token, "knowledge-base", "articles:delete")
    print("articles:delete ->", denied)


if __name__ == "__main__":
    main()
