import calendar
import json
import logging
import time
from urllib.parse import urlparse, urlencode
from typing import Callable, Optional

from alibabacloud_credentials.provider.refreshable import Credentials, RefreshResult, RefreshCachedSupplier
from alibabacloud_credentials.http import HttpOptions
from Tea.core import TeaCore
from alibabacloud_credentials_api import ICredentialsProvider
from alibabacloud_credentials.utils import parameter_helper as ph
from alibabacloud_credentials.exceptions import CredentialException

log = logging.getLogger('credentials')
log.setLevel(logging.INFO)
ch = logging.StreamHandler()
log.addHandler(ch)

# OAuth 令牌更新回调函数类型
OAuthTokenUpdateCallback = Callable[[str, str, str, str, str, int, int], None]
OAuthTokenUpdateCallbackAsync = Callable[[str, str, str, str, str, int, int], None]


def _get_stale_time(expiration: int) -> int:
    if expiration < 0:
        return int(time.mktime(time.localtime())) + 60 * 60
    # OAuth STS credentials are persisted in the CLI profile and should be
    # reused for their complete lifetime.  Using an earlier stale time causes
    # every credentials lookup near expiration to enter the refresh path even
    # though the persisted STS credential is still valid.
    return expiration


class OAuthCredentialsProvider(ICredentialsProvider):
    DEFAULT_CONNECT_TIMEOUT = 5000
    DEFAULT_READ_TIMEOUT = 10000

    def __init__(self, *,
                 client_id: str = None,
                 sign_in_url: str = None,
                 access_token: str = None,
                 access_token_expire: int = 0,
                 refresh_token: str = None,
                 access_key_id: str = None,
                 access_key_secret: str = None,
                 security_token: str = None,
                 sts_expiration: int = None,
                 http_options: HttpOptions = None,
                 token_update_callback: Optional[OAuthTokenUpdateCallback] = None,
                 token_update_callback_async: Optional[OAuthTokenUpdateCallbackAsync] = None):

        if not client_id:
            raise ValueError('the ClientId is empty')

        if not sign_in_url:
            raise ValueError('the url for sign-in is empty')

        self._client_id = client_id
        self._sign_in_url = sign_in_url
        self._access_token = access_token
        self._access_token_expire = access_token_expire
        self._refresh_token = refresh_token
        # Cached STS credential previously obtained from a token exchange and
        # persisted alongside the OAuth tokens (e.g. in the CLI config file).
        # Reusing it until ``sts_expiration`` avoids exchanging on every fresh
        # provider build, matching aliyun-cli's OAuth resolution.
        self._sts_access_key_id = access_key_id
        self._sts_access_key_secret = access_key_secret
        self._sts_security_token = security_token
        self._sts_expiration = sts_expiration
        self._token_update_callback = token_update_callback
        self._token_update_callback_async = token_update_callback_async

        self._http_options = http_options if http_options is not None else HttpOptions()
        self._runtime_options = {
            'connectTimeout': self._http_options.connect_timeout if self._http_options.connect_timeout is not None else OAuthCredentialsProvider.DEFAULT_CONNECT_TIMEOUT,
            'readTimeout': self._http_options.read_timeout if self._http_options.read_timeout is not None else OAuthCredentialsProvider.DEFAULT_READ_TIMEOUT,
            'httpsProxy': self._http_options.proxy
        }
        self._credentials_cache = RefreshCachedSupplier(
            refresh_callable=self._refresh_credentials,
            refresh_callable_async=self._refresh_credentials_async,
        )

    def get_credentials(self) -> Credentials:
        return self._credentials_cache._sync_call()

    async def get_credentials_async(self) -> Credentials:
        return await self._credentials_cache._async_call()

    def _reuse_cached_sts(self) -> Optional[RefreshResult]:
        """Return the cached STS credential when it is still valid.

        Mirrors aliyun-cli's OAuth handling (config/profile.go): if a previously
        exchanged STS credential is present and not yet expired, reuse it instead
        of calling ``/v1/exchange``. This keeps a rotating STS AccessKey id stable
        across fresh provider builds and, crucially, avoids re-triggering the
        token-update callback (which rewrites the config file) on every resolve.
        """
        if (self._sts_access_key_id and self._sts_access_key_secret
                and self._sts_security_token and self._sts_expiration
                and self._sts_expiration > int(time.mktime(time.localtime()))):
            credentials = Credentials(
                access_key_id=self._sts_access_key_id,
                access_key_secret=self._sts_access_key_secret,
                security_token=self._sts_security_token,
                expiration=self._sts_expiration,
                provider_name=self.get_provider_name(),
            )
            return RefreshResult(value=credentials,
                                 stale_time=_get_stale_time(self._sts_expiration))
        return None

    def _store_exchanged_sts(self, credentials: Credentials, expiration: int) -> None:
        """Remember the freshly exchanged STS so later resolves can reuse it."""
        self._sts_access_key_id = credentials.get_access_key_id()
        self._sts_access_key_secret = credentials.get_access_key_secret()
        self._sts_security_token = credentials.get_security_token()
        self._sts_expiration = expiration

    def _try_refresh_oauth_token(self) -> None:
        current_time = int(time.mktime(time.localtime()))
        # 构建刷新令牌请求
        r = urlparse(self._sign_in_url)
        tea_request = ph.get_new_request()
        tea_request.headers['host'] = r.hostname
        tea_request.port = r.port
        tea_request.protocol = r.scheme
        tea_request.method = 'POST'
        tea_request.pathname = '/v1/token'

        # 设置请求体
        body_data = {
            'grant_type': 'refresh_token',
            'refresh_token': self._refresh_token,
            'client_id': self._client_id,
            'Timestamp': ph.get_iso_8061_date()
        }
        tea_request.body = urlencode(body_data)
        tea_request.headers['Content-Type'] = 'application/x-www-form-urlencoded'

        response = TeaCore.do_action(tea_request, self._runtime_options)

        if response.status_code != 200:
            raise CredentialException(f"failed to refresh OAuth token, status code: {response.status_code}, response: {response.body.decode('utf-8')}")

        # 解析响应
        dic = json.loads(response.body.decode('utf-8'))
        if 'access_token' not in dic or 'refresh_token' not in dic:
            raise CredentialException(f"failed to refresh OAuth token: {response.body.decode('utf-8')}")

        # 更新令牌
        new_access_token = dic.get('access_token')
        new_refresh_token = dic.get('refresh_token')
        expires_in = dic.get('expires_in', 3600)
        new_access_token_expire = current_time + expires_in

        self._access_token = new_access_token
        self._refresh_token = new_refresh_token
        self._access_token_expire = new_access_token_expire

    async def _try_refresh_oauth_token_async(self) -> None:
        current_time = int(time.mktime(time.localtime()))
        # 构建刷新令牌请求
        r = urlparse(self._sign_in_url)
        tea_request = ph.get_new_request()
        tea_request.headers['host'] = r.hostname
        tea_request.port = r.port
        tea_request.protocol = r.scheme
        tea_request.method = 'POST'
        tea_request.pathname = '/v1/token'

        # 设置请求体
        body_data = {
            'grant_type': 'refresh_token',
            'refresh_token': self._refresh_token,
            'client_id': self._client_id,
            'Timestamp': ph.get_iso_8061_date()
        }
        tea_request.body = urlencode(body_data)
        tea_request.headers['Content-Type'] = 'application/x-www-form-urlencoded'

        response = await TeaCore.async_do_action(tea_request, self._runtime_options)

        if response.status_code != 200:
            raise CredentialException(f"failed to refresh OAuth token, status code: {response.status_code}, response: {response.body.decode('utf-8')}")

        # 解析响应
        dic = json.loads(response.body.decode('utf-8'))
        if 'access_token' not in dic or 'refresh_token' not in dic:
            raise CredentialException(f"failed to refresh OAuth token: {response.body.decode('utf-8')}")

        # 更新令牌
        new_access_token = dic.get('access_token')
        new_refresh_token = dic.get('refresh_token')
        expires_in = dic.get('expires_in', 3600)
        new_access_token_expire = current_time + expires_in

        self._access_token = new_access_token
        self._refresh_token = new_refresh_token
        self._access_token_expire = new_access_token_expire

    def _refresh_credentials(self) -> RefreshResult[Credentials]:
        cached = self._reuse_cached_sts()
        if cached is not None:
            return cached

        if self._refresh_token and (
                self._access_token is None or self._access_token_expire <= 0 or self._access_token_expire - int(
                time.mktime(time.localtime())) <= 1200):
            self._try_refresh_oauth_token()

        r = urlparse(self._sign_in_url)
        tea_request = ph.get_new_request()
        tea_request.headers['host'] = r.hostname
        tea_request.port = r.port
        tea_request.protocol = r.scheme
        tea_request.method = 'POST'
        tea_request.pathname = '/v1/exchange'

        tea_request.headers['Content-Type'] = 'application/json'
        tea_request.headers['Authorization'] = f'Bearer {self._access_token}'

        response = TeaCore.do_action(tea_request, self._runtime_options)

        if response.status_code != 200:
            raise CredentialException(
                f"error refreshing credentials from OAuth, http_code: {response.status_code}, result: {response.body.decode('utf-8')}")

        dic = json.loads(response.body.decode('utf-8'))
        if 'error' in dic:
            raise CredentialException(
                f"error retrieving credentials from OAuth result: {response.body.decode('utf-8')}")

        if 'AccessKeyId' not in dic or 'AccessKeySecret' not in dic or 'SecurityToken' not in dic:
            raise CredentialException(
                f"error retrieving credentials from OAuth result: {response.body.decode('utf-8')}")

        # 先转换为时间数组
        time_array = time.strptime(dic.get('Expiration'), '%Y-%m-%dT%H:%M:%SZ')
        # 转换为时间戳
        expiration = calendar.timegm(time_array)
        credentials = Credentials(
            access_key_id=dic.get('AccessKeyId'),
            access_key_secret=dic.get('AccessKeySecret'),
            security_token=dic.get('SecurityToken'),
            expiration=expiration,
            provider_name=self.get_provider_name()
        )
        self._store_exchanged_sts(credentials, expiration)

        # 调用令牌更新回调函数
        if self._token_update_callback:
            try:
                self._token_update_callback(
                    self._refresh_token,
                    self._access_token,
                    credentials.get_access_key_id(),
                    credentials.get_access_key_secret(),
                    credentials.get_security_token(),
                    self._access_token_expire,
                    expiration
                )
            except Exception as e:
                log.warning(f'failed to update OAuth tokens in config file: {e}')

        return RefreshResult(value=credentials,
                             stale_time=_get_stale_time(expiration))

    async def _refresh_credentials_async(self) -> RefreshResult[Credentials]:
        cached = self._reuse_cached_sts()
        if cached is not None:
            return cached

        if self._refresh_token and (
                self._access_token is None or self._access_token_expire <= 0 or self._access_token_expire - int(
                time.mktime(time.localtime())) <= 1200):
            await self._try_refresh_oauth_token_async()

        r = urlparse(self._sign_in_url)
        tea_request = ph.get_new_request()
        tea_request.headers['host'] = r.hostname
        tea_request.port = r.port
        tea_request.protocol = r.scheme
        tea_request.method = 'POST'
        tea_request.pathname = '/v1/exchange'

        tea_request.headers['Content-Type'] = 'application/json'
        tea_request.headers['Authorization'] = f'Bearer {self._access_token}'

        response = await TeaCore.async_do_action(tea_request, self._runtime_options)

        if response.status_code != 200:
            raise CredentialException(
                f"error refreshing credentials from OAuth, http_code: {response.status_code}, result: {response.body.decode('utf-8')}")

        dic = json.loads(response.body.decode('utf-8'))
        if 'error' in dic:
            raise CredentialException(
                f"error retrieving credentials from OAuth result: {response.body.decode('utf-8')}")

        if 'AccessKeyId' not in dic or 'AccessKeySecret' not in dic or 'SecurityToken' not in dic:
            raise CredentialException(
                f"error retrieving credentials from OAuth result: {response.body.decode('utf-8')}")

        # 先转换为时间数组
        time_array = time.strptime(dic.get('Expiration'), '%Y-%m-%dT%H:%M:%SZ')
        # 转换为时间戳
        expiration = calendar.timegm(time_array)
        credentials = Credentials(
            access_key_id=dic.get('AccessKeyId'),
            access_key_secret=dic.get('AccessKeySecret'),
            security_token=dic.get('SecurityToken'),
            expiration=expiration,
            provider_name=self.get_provider_name()
        )
        self._store_exchanged_sts(credentials, expiration)

        if self._token_update_callback_async:
            try:
                await self._token_update_callback_async(
                    self._refresh_token,
                    self._access_token,
                    credentials.get_access_key_id(),
                    credentials.get_access_key_secret(),
                    credentials.get_security_token(),
                    self._access_token_expire,
                    expiration
                )
            except Exception as e:
                log.warning(f'failed to update OAuth tokens in config file: {e}')

        return RefreshResult(value=credentials,
                             stale_time=_get_stale_time(expiration))

    def _get_client_id(self) -> str:
        """获取客户端ID"""
        return self._client_id

    def get_provider_name(self) -> str:
        return 'oauth'