"""
auth/token_store.py — Lagre og hente OAuth2-tokens per klient i Secret Manager.

Hvert token lagres som en JSON-streng under secret-navn:
  osvauco-client-token-{client_id}

Bruk:
  from auth.token_store import save_token, load_credentials

  save_token("klient-abc", token_dict)
  creds = load_credentials("klient-abc")  # google.oauth2.credentials.Credentials
"""

import json
import os
from google.cloud import secretmanager
from google.oauth2.credentials import Credentials

PROJECT_ID = os.environ.get("PROJECT_ID", "propane-will-491900-m5")


def _secret_name(client_id: str) -> str:
    return f"osvauco-client-token-{client_id}"


def save_token(client_id: str, token_dict: dict) -> None:
    """
    Lagrer eller oppdaterer OAuth2-token for klient i Secret Manager.
    Oppretter secret hvis den ikke finnes.
    """
    client = secretmanager.SecretManagerServiceClient()
    parent = f"projects/{PROJECT_ID}"
    secret_id = _secret_name(client_id)
    secret_path = f"{parent}/secrets/{secret_id}"
    payload = json.dumps(token_dict).encode("utf-8")

    # Opprett secret hvis den ikke finnes
    try:
        client.get_secret(name=secret_path)
    except Exception:
        client.create_secret(
            request={
                "parent": parent,
                "secret_id": secret_id,
                "secret": {"replication": {"automatic": {}}},
            }
        )

    # Legg til ny versjon (ny verdi)
    client.add_secret_version(
        request={"parent": secret_path, "payload": {"data": payload}}
    )


def load_credentials(client_id: str) -> Credentials:
    """
    Henter siste token for klient fra Secret Manager.
    Returnerer google.oauth2.credentials.Credentials klar til bruk.
    Kaster KeyError hvis client_id ikke finnes.
    """
    sm_client = secretmanager.SecretManagerServiceClient()
    secret_path = f"projects/{PROJECT_ID}/secrets/{_secret_name(client_id)}/versions/latest"
    try:
        response = sm_client.access_secret_version(name=secret_path)
    except Exception as exc:
        raise KeyError(f"Ingen token funnet for klient '{client_id}': {exc}") from exc

    token_dict = json.loads(response.payload.data.decode("utf-8"))
    return Credentials(
        token=token_dict.get("token"),
        refresh_token=token_dict.get("refresh_token"),
        token_uri=token_dict.get("token_uri", "https://oauth2.googleapis.com/token"),
        client_id=token_dict.get("client_id"),
        client_secret=token_dict.get("client_secret"),
        scopes=token_dict.get("scopes"),
    )