gem 'easy_code_sign'

require 'easy_code_sign'

EasyCodeSign.configure do |config|
  # Token provider (:safenet is currently supported)
  config.provider = :safenet

  # Path to PKCS#11 library (auto-detected if not specified)
  config.pkcs11_library = '/usr/local/lib/libeToken.dylib'

  # Token slot index (default: 0)
  config.slot_index = 0

  # Timestamp authority URL (optional)
  config.timestamp_authority = 'http://timestamp.digicert.com'

  # Hash algorithm for timestamps (default: :sha256)
  config.timestamp_hash_algorithm = :sha256

  # Require timestamp for all signatures (default: false)
  config.require_timestamp = false

  # Check certificate revocation during verification (default: true)
  config.check_revocation = true

  # Network timeout in seconds (default: 30)
  config.network_timeout = 30

  # Custom trust store path for verification (optional)
  config.trust_store_path = '/path/to/custom/ca-certs'

  # PIN callback for interactive PIN entry
  config.pin_callback = ->(slot_info) {
    print "Enter PIN for #{slot_info[:slot_index]}: "
    $stdin.noecho(&:gets).chomp
  }
end

# Sign a gem
result = EasyCodeSign.sign('my_gem-1.0.0.gem', pin: '1234')
puts "Signed: #{result.file_path}"
puts "Signer: #{result.signer_name}"

# Sign with timestamp
result = EasyCodeSign.sign('my_gem-1.0.0.gem',
  pin: '1234',
  timestamp: true
)
puts "Timestamp: #{result.timestamp}"

# Sign with custom output path
result = EasyCodeSign.sign('archive.zip',
  pin: '1234',
  output_path: 'signed_archive.zip',
  algorithm: :sha256_rsa
)

# Batch signing (single token session)
signer = EasyCodeSign.signer
results = signer.sign_batch(
  ['gem1.gem', 'gem2.gem', 'archive.zip'],
  pin: '1234'
)

# Verify a signed file
result = EasyCodeSign.verify('signed.gem')

if result.valid?
  puts "Signature is valid!"
  puts "Signed by: #{result.signer_name}"
  puts "Organization: #{result.signer_organization}"

  if result.timestamped?
    puts "Timestamp: #{result.timestamp}"
    puts "TSA: #{result.timestamp_authority}"
  end
else
  puts "Verification failed:"
  result.errors.each { |e| puts "  - #{e}" }
end

# Detailed verification status
puts "Signature valid: #{result.signature_valid?}"
puts "Integrity valid: #{result.integrity_valid?}"
puts "Certificate valid: #{result.certificate_valid?}"
puts "Chain valid: #{result.chain_valid?}"
puts "Trusted: #{result.trusted?}"

# Get full result as hash
puts result.to_h

# Use custom trust store
trust_store = EasyCodeSign::Verification::TrustStore.new
trust_store.add_file('/path/to/custom_ca.pem')
result = EasyCodeSign.verify('signed.gem', trust_store: trust_store)

# Batch verification
verifier = EasyCodeSign.verifier
results = verifier.verify_batch(['file1.gem', 'file2.zip'])
results.each do |path, result|
  puts "#{path}: #{result.valid? ? 'VALID' : 'INVALID'}"
end

# List available token slots
slots = EasyCodeSign.list_slots
slots.each do |slot|
  puts "Slot #{slot[:index]}: #{slot[:token_label]}"
  puts "  Serial: #{slot[:serial]}"
end

# Direct provider access
provider = EasyCodeSign.provider
provider.with_session(pin: '1234') do |session|
  cert = session.certificate
  puts "Certificate: #{cert.subject}"
  puts "Expires: #{cert.not_after}"

  chain = session.certificate_chain
  puts "Chain length: #{chain.length}"
end

begin
  EasyCodeSign.sign('file.gem', pin: '1234')
rescue EasyCodeSign::TokenNotFoundError
  puts "Hardware token not connected"
rescue EasyCodeSign::PinError => e
  puts "PIN error: #{e.message}"
  puts "Retries remaining: #{e.retries_remaining}" if e.retries_remaining
rescue EasyCodeSign::TokenLockedError
  puts "Token is locked - contact your administrator"
rescue EasyCodeSign::TimestampAuthorityError => e
  puts "Timestamp failed: #{e.message}"
  puts "HTTP status: #{e.http_status}" if e.http_status
rescue EasyCodeSign::InvalidFileError => e
  puts "Invalid file: #{e.message}"
rescue EasyCodeSign::Error => e
  puts "Signing error: #{e.message}"
end