import os
import requests


def _get_identity_token(audience: str) -> str:
    """Hent GCE metadata identity token (LEARNING-013)."""
    url = (
        "http://metadata.google.internal/computeMetadata/v1/instance/"
        f"service-accounts/default/identity?audience={audience}&format=full"
    )
    try:
        r = requests.get(url, headers={"Metadata-Flavor": "Google"}, timeout=5)
        r.raise_for_status()
        return r.text
    except Exception:
        return os.environ.get("OPAX_TOKEN", "")


class OpaxClient:
    """
    Emma sin tilgang til OPAX-portalen.
    Guardrail-sjekk kjøres automatisk før hvert kall.
    """

    def __init__(self, guardrails=None):
        OSVX_MCP_URL = os.getenv('OSVX_MCP_URL')
        if not OSVX_MCP_URL:
            raise ValueError("OSVX_MCP_URL environment variable not set.")
        self.base_url = OSVX_MCP_URL.rstrip("/")
        self.guardrails = guardrails
        self._token: str = ""

    def _auth_headers(self) -> dict:
        if not self._token:
            self._token = _get_identity_token(self.base_url)
        return {"Authorization": f"Bearer {self._token}", "Content-Type": "application/json"}

    def health(self) -> dict:
        r = requests.get(f"{self.base_url}/health", headers=self._auth_headers(), timeout=10)
        r.raise_for_status()
        return r.json()

    def query(self, prompt: str) -> dict:
        if self.guardrails:
            ok, reason = self.guardrails.can_execute(prompt)
            if not ok:
                return {"error": reason}
        r = requests.post(
            f"{self.base_url}/api/query",
            json={"prompt": prompt},
            headers=self._auth_headers(),
            timeout=30,
        )
        r.raise_for_status()
        return r.json()