// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

'use strict';

async function main(
  projectId = 'my-project',
  locationId = 'us-east1',
  keyRingId = 'my-key-ring',
  cryptoKeyId = 'my-imported-key',
  importJobId = 'my-import-job'
) {
  // [START kms_import_manually_wrapped_key]
  //
  // TODO(developer): Uncomment these variables before running the sample.
  //
  // const projectId = 'my-project';
  // const locationId = 'us-east1';
  // const keyRingId = 'my-key-ring';
  // const cryptoKeyId = 'my-imported-key';
  // const importJobId = 'my-import-job';

  // Imports the Cloud KMS library
  const {KeyManagementServiceClient} = require('@google-cloud/kms');

  // Instantiates a client
  const client = new KeyManagementServiceClient();

  // Build the crypto key and importjob resource names
  const cryptoKeyName = client.cryptoKeyPath(
    projectId,
    locationId,
    keyRingId,
    cryptoKeyId
  );
  const importJobName = client.importJobPath(
    projectId,
    locationId,
    keyRingId,
    importJobId
  );

  async function wrapAndImportKey() {
    // Generate a 32-byte key to import.
    const crypto = require('crypto');
    const targetKey = crypto.randomBytes(32);

    const [importJob] = await client.getImportJob({name: importJobName});

    // Wrap the target key using the import job key
    const wrappedTargetKey = crypto.publicEncrypt(
      {
        key: importJob.publicKey.pem,
        oaepHash: 'sha256',
        padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
      },
      targetKey
    );

    // Import the target key version
    const [version] = await client.importCryptoKeyVersion({
      parent: cryptoKeyName,
      importJob: importJobName,
      algorithm: 'GOOGLE_SYMMETRIC_ENCRYPTION',
      wrappedKey: wrappedTargetKey,
    });

    console.log(`Imported key version: ${version.name}`);
    return version;
  }

  return wrapAndImportKey();
  // [END kms_import_manually_wrapped_key]
}
module.exports.main = main;

/* c8 ignore next 10 */
if (require.main === module) {
  main(...process.argv.slice(2)).catch(err => {
    console.error(err.message);
    process.exitCode = 1;
  });
  process.on('unhandledRejection', err => {
    console.error(err.message);
    process.exitCode = 1;
  });
}
