cryptoCmd

var FileCryptoCmd = &cobra.Command{
	Use:     "file-crypt <file-path>",
	Aliases: []string{"fc"},
	Short:   "Encrypt or decrypt files using AES-256-GCM symmetric encryption",
	Long: `Performs symmetric encryption and decryption on files.
A password is required for both operations.

Examples:
  # Encrypt a file (outputs file.zip.enc)
  anbu file-crypt /path/to/file.zip -p "P@55w0rd"

  # Decrypt a file (outputs file.zip)
  anbu file-crypt /path/to/file.zip.enc -p "P@55w0rd" -d`,
	Args: cobra.ExactArgs(1),
	Run: func(cmd *cobra.Command, args []string) {
		if fileCryptoFlags.password == "" {
			log.Fatal().Msg("No password specified")
		}
		if fileCryptoFlags.decrypt {
			anbuCrypto.DecryptFileSymmetric(args[0], fileCryptoFlags.password)
		} else {
			anbuCrypto.EncryptFileSymmetric(args[0], fileCryptoFlags.password)
		}
	},
}

var KeyPairCmd = &cobra.Command{
	Use:     "key-pair",
	Aliases: []string{},
	Short:   "Generate RSA key pairs in PEM or SSH format",
	Long: `Generates RSA public and private key pairs.
Supports standard PEM format for general use and OpenSSH format for SSH authentication.

Examples:
  # Generate a 4096-bit RSA key pair in PEM format
  anbu key-pair -o my-key -k 4096

  # Generate a default 2048-bit RSA key pair in SSH format
  anbu key-pair --ssh -o my-ssh-key`,
	Run: func(cmd *cobra.Command, args []string) {
		keyName := filepath.Base(keyPairFlags.outputPath)
		keyDir := filepath.Dir(keyPairFlags.outputPath)
		if keyPairFlags.noSSHFormat {
			anbuCrypto.GenerateKeyPair(keyDir, keyName, keyPairFlags.keySize)
		} else {
			anbuCrypto.GenerateSSHKeyPair(keyDir, keyName, keyPairFlags.keySize)
		}
	},
}

var SecretsCmd = &cobra.Command{
	Use:     "pass",
	Aliases: []string{"p"},
	Short:   "Manage secrets securely with AES-GCM encryption",
	Long: `A secure store for secrets, which are encrypted at rest using AES-GCM.
The store is protected by a master password derived from the ANBUPW environment
variable or entered interactively.

Examples:
  # List all stored secret IDs
  anbu pass list

  # Add a new secret
  anbu pass add my-api-key

  # Add a multi-line secret like a private key
  anbu pass add my-ssh-key -m

  # Retrieve and print a secret's value
  anbu pass get my-api-key

  # Delete a secret
  anbu pass delete my-api-key

  # Export all secrets (decrypted) to a JSON file
  anbu pass export secrets_backup.json

  # Import secrets from a JSON file
  anbu pass import secrets_backup.json`,
}

var SecretsScanCmd = &cobra.Command{
	Use:     "secret-scan [path]",
	Aliases: []string{},
	Short:   "Scan a directory for potential secrets using regex patterns",
	Long: `Scans files in a given directory for secrets like API keys and tokens.
If no path is provided, it scans the current directory.
The scan ignores binary files, dotfiles, and common development directories.

Examples:
  # Scan the current directory for high-confidence secrets
  anbu secret-scan

  # Scan a specific project path
  anbu secret-scan /path/to/my-project

  # Scan and include generic, lower-confidence matches
  anbu secret-scan /path/to/my-project -p`,
	Args: cobra.MaximumNArgs(1),
	Run: func(cmd *cobra.Command, args []string) {
		scanPath := "."
		if len(args) > 0 {
			scanPath = args[0]
		}
		anbuCrypto.ScanSecretsInPath(scanPath, printFalsePositives)
	},
}