plm-lottery/scripts/generate_master_key.py

"""One-time ops bootstrap: generate and encrypt the server's master xprv.

Usage:
    python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
    # write it to the file XPRV_ENCRYPTION_KEY_FILE (.env) points at, then:
    python scripts/generate_master_key.py
"""

from app.config import settings
from app.wallet.hd import generate_master_key
from app.wallet.verify import load_sample

if __name__ == "__main__":
    if not settings.xprv_encryption_key:
        raise SystemExit("XPRV_ENCRYPTION_KEY_FILE is not set, or its file is missing or empty")
    sample = load_sample()
    if sample.users or sample.rounds or sample.seeds:
        # SEC-50: a new key cannot reproduce the addresses the database already holds.
        raise SystemExit("the database already has users or rounds: a new key would not reproduce their addresses")
    generate_master_key()
    print(f"Master key written (encrypted) to {settings.master_key_path}")