param(
    [int]$KeySize = 3072,
    [string]$KeyId = "omika-qr-2026-01"
)

$ErrorActionPreference = 'Stop'

# Garde de sécurité : la signature des QR d'inscription exige RSA 3072 bits minimum.
if ($KeySize -lt 3072) {
    throw "RSA 3072 bits minimum requis."
}

Write-Host "Generation de la paire de cles RSA ($KeySize bits)..." -ForegroundColor Cyan

$rsa = New-Object `
    -TypeName System.Security.Cryptography.RSACryptoServiceProvider `
    -ArgumentList $KeySize

$rsa.PersistKeyInCsp = $false

try {
    if ($rsa.KeySize -lt 3072) {
        throw "La cle RSA generee est inferieure a 3072 bits."
    }

    if ($rsa.KeySize -ne $KeySize) {
        throw "La taille RSA generee ($($rsa.KeySize)) ne correspond pas a la taille demandee ($KeySize)."
    }

    $publicXml = $rsa.ToXmlString($false)
    $privateXml = $rsa.ToXmlString($true)
}
finally {
    $rsa.Dispose()
}
Write-Host ""
Write-Host "============================================================" -ForegroundColor Cyan
Write-Host " PAIRES DE CLES RSA ($KeySize bits)kid : $KeyId" -ForegroundColor Cyan
Write-Host "============================================================" -ForegroundColor Cyan
Write-Host ""
Write-Host "1) CLE PUBLIQUE (a embarquer dans le CLIENT) :" -ForegroundColor Green
Write-Host ""
Write-Host $publicXml -ForegroundColor Green
Write-Host ""
Write-Host "2) CLE PRIVEE (SERVEUR UNIQUEMENT NE JAMAIS COMMITTER) :" -ForegroundColor Red
Write-Host ""
Write-Host $privateXml -ForegroundColor Red
Write-Host ""
Write-Host "============================================================" -ForegroundColor Cyan
Write-Host "Instructions :" -ForegroundColor Cyan
Write-Host " - Serveur : configurer LicenseQr:PrivateKeyXml (cle privee ci-dessus)" -ForegroundColor Cyan
Write-Host "             et LicenseQr:KeyId = '$KeyId'." -ForegroundColor Cyan
Write-Host " - Client  : ajouter la cle publique ci-dessus au registre" -ForegroundColor Cyan
Write-Host "             EnrollmentVerificationKey.PublicKeysByKeyId sous le kid '$KeyId'." -ForegroundColor Cyan
Write-Host " - Ne jamais placer la cle privee dans le depot, l'APK, l'IPA ou le Desktop." -ForegroundColor Cyan
Write-Host "============================================================" -ForegroundColor Cyan