from typing import Optional


class AttestedAgent:
    """A lightweight attested agent scaffold.

    Each agent has an id and a hardware class. Attestation generates a credential that
    would be used to enforce contract permissions in a real deployment.
    """

    def __init__(self, agent_id: str, hardware: str = "TEE"):  # pragma: no cover - trivial
        self.agent_id = agent_id
        self.hardware = hardware
        self._credential: Optional[str] = None
        # Lightweight DID-style identity; in a real system this would be bound to
        # a hardware-backed identity and rotated periodically.
        self._did: Optional[str] = None

    def attest(self) -> bool:
        # In a real system, remote attestation would happen here.
        self._credential = f"attest-{self.agent_id}-{self.hardware}-v1"
        # Issue or refresh a minimal DID identity alongside attestation
        if self._did is None:
            self._did = f"did:gridguard:{self.agent_id}"
        return True

    @property
    def credential(self) -> Optional[str]:
        return self._credential

    def verify_credential(self, credential: str) -> bool:
        """Lightweight credential verifier.

        In a real deployment this would cryptographically verify the
        remote attestation report. Here we perform a deterministic check
        against the produced credential for testability and auditing.
        """
        expected = f"attest-{self.agent_id}-{self.hardware}-v1"
        return credential == expected

    @property
    def did(self) -> str:
        """Return the agent's Decentralized Identifier (DID).

        If not yet issued, lazily generate a simple DID. This is a lightweight
        stand-in for DID/identity binding in MVP contexts.
        """
        if self._did is None:
            self._did = f"did:gridguard:{self.agent_id}"
        return self._did

    def rotate_identity(self) -> None:
        """Rotate the agent's identity to simulate short-lived credentials.

        In a production system this would refresh attestation keys and rotate
        credentials. Here we simply mutate the DID suffix to reflect rotation.
        """
        suffix = getattr(self, "_did", None)
        if suffix is None:
            self._did = f"did:gridguard:{self.agent_id}"
        else:
            # Simple rotation by appending a timestamp-like suffix
            import time
            self._did = f"did:gridguard:{self.agent_id}:{int(time.time())}"