"""
Seed the demo tables.

- writes the raw customer record into the customers table (this is the data that
  must never leave the "on-prem" zone)
- OPTIONALLY writes a demo vault mapping (CUST_000123 -> cust-0001) so you can
  test the RAG Lambda on its own, before Fusion is wired in.

In the real flow Fusion mints a fresh, random token per request and writes the
vault entry itself; the --with-demo-token entry is only a standalone test aid.

Usage:
  VAULT_TABLE=hncb-deid-demo-vault CUSTOMERS_TABLE=hncb-deid-demo-customers \
    python seed.py --with-demo-token
"""
import argparse
import json
import os
import time
import boto3

ddb = boto3.resource("dynamodb")


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--customers-table", default=os.environ.get("CUSTOMERS_TABLE"))
    ap.add_argument("--vault-table", default=os.environ.get("VAULT_TABLE"))
    ap.add_argument("--with-demo-token", action="store_true")
    args = ap.parse_args()

    here = os.path.dirname(__file__)
    with open(os.path.join(here, "customers.json"), encoding="utf-8") as f:
        customers = json.load(f)

    ct = ddb.Table(args.customers_table)
    for c in customers:
        ct.put_item(Item=c)
        print(f"seeded customer {c['customer_id']} ({c['name']})")

    if args.with_demo_token:
        vt = ddb.Table(args.vault_table)
        vt.put_item(Item={
            "token": "CUST_000123",
            "type": "CUSTOMER",
            "value": "cust-0001",
            "expires_at": int(time.time()) + 3600,
        })
        print("seeded demo vault mapping CUST_000123 -> cust-0001 (test aid only)")


if __name__ == "__main__":
    main()