import { CodeBlock } from "../components/CodeBlock";
import { Callout } from "../components/Callout";

export function ApiKeysPage() {
  return (
    <div>
      <h1 id="api-keys">API Key Management</h1>
      <p>
        Veylant IA never stores plain-text API keys. Provider keys (OpenAI, Anthropic, etc.) are
        stored in HashiCorp Vault and rotated on a 90-day cycle. User-facing API keys use a
        prefix+hash scheme.
      </p>

      <h2 id="key-format">API Key Format</h2>
      <p>
        Veylant IA user API keys follow the format <code>sk-vyl_{"{prefix}"}{"{hash}"}</code>:
      </p>
      <CodeBlock
        language="text"
        code={`sk-vyl_ab12cd34ef56gh78ij90kl12mn34op56qr78st90

─────┬──── ──────┬──── ──────────────────────────────────────────
  prefix     display    hash (SHA-256, truncated, stored in DB)
              prefix`}
      />
      <ul>
        <li>The display prefix (<code>ab12cd34</code>) is stored in plaintext for key identification in the dashboard</li>
        <li>The full key is SHA-256 hashed; only the hash is stored in PostgreSQL</li>
        <li>If a key is compromised, only the prefix reveals which key to revoke — not the key value</li>
      </ul>

      <h2 id="provider-keys">Provider API Keys</h2>
      <Callout type="warning" title="Never commit provider keys">
        Provider API keys (OpenAI, Anthropic, etc.) must never be committed to the repository.
        Use environment variables or HashiCorp Vault.
      </Callout>

      <CodeBlock
        language="bash"
        code={`# Set via environment variable (recommended for docker-compose)
export VEYLANT_PROVIDERS_OPENAI_API_KEY=sk-...

# Or load from HashiCorp Vault
vault kv put secret/veylant/providers openai_api_key=sk-... anthropic_api_key=sk-ant-...

# Vault agent sidecar injects secrets as environment variables at runtime`}
      />

      <h2 id="rotation">Key Rotation</h2>
      <p>Provider API keys are rotated on a 90-day cycle via Vault:</p>
      <ol>
        <li>Generate new API key from the provider portal</li>
        <li>Write new key to Vault: <code>vault kv patch secret/veylant/providers openai_api_key=sk-new...</code></li>
        <li>Vault agent syncs the new value to running pods automatically (no restart needed)</li>
        <li>Revoke the old key from the provider portal</li>
      </ol>

      <h2 id="secret-detection">Secret Detection in CI</h2>
      <p>
        Every commit is scanned by <strong>gitleaks</strong> for accidentally committed secrets.
        Any string matching common API key patterns (starting with <code>sk-</code>,{" "}
        <code>sk-ant-</code>, etc.) blocks the CI pipeline.
      </p>
      <CodeBlock
        language="bash"
        code={`# Run gitleaks locally before committing
gitleaks detect --source .

# The Semgrep rule also catches sk- literals in Go/Python source:
# ID: hardcoded-api-key`}
      />

      <h2 id="audit">Key Usage Auditing</h2>
      <p>
        Every AI request records which API key (by prefix) was used in the ClickHouse audit log.
        This allows you to trace the source of any request to a specific service or developer.
      </p>
      <CodeBlock
        language="bash"
        code={`# Find all requests from a specific API key prefix
curl "http://localhost:8090/v1/admin/logs?api_key_prefix=ab12cd34" \\
  -H "Authorization: Bearer $TOKEN"`}
      />
    </div>
  );
}
