#!/usr/bin/env python3
import base64, subprocess
seed=bytes(range(1,33)); stellar=base64.b32encode(bytes([18<<3])+seed+b'\0\0').decode()
ident=subprocess.run(['python3','stellar-recover.py','identity',stellar],check=True,text=True,capture_output=True).stdout.strip(); recipient=subprocess.run(['age-keygen','-y'],input=ident+'\n',check=True,text=True,capture_output=True).stdout.strip()
r=subprocess.run(['python3','custody-cli.py','recipient','--mode','age','--age-recipient',recipient],check=True,text=True,capture_output=True); assert r.stdout.strip()==recipient
r=subprocess.run(['python3','custody-cli.py','recipient','--mode','age','--age-recipient',recipient,'--stellar-public','GNOTALLOWED'],text=True,capture_output=True); assert r.returncode!=0
r=subprocess.run(['python3','custody-cli.py','decrypt-share','--mode','age','--stellar-secret-file','never-read','x','y'],text=True,capture_output=True); assert r.returncode!=0 and 'age mode requires only' in r.stderr
print('PASS CLI explicit dual modes and disjoint secret options')