"""Config file for lambda function."""

import os
import typing

from secrets_manager.lambda_ext import LambdaSecretsManager
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization

APPLICATION_NAME = 'lambda-sr-delivery-tiktok-ack-processor'
SR_DELIVERY_TIKTOK_APPLICATION_NAME = 'lambda-sr-delivery-tiktok'

# AWS region configuration
DEFAULT_AWS_REGION = 'us-east-1'
AWS_REGION = os.environ.get('AWS_REGION', DEFAULT_AWS_REGION)

# Environment setup
DEV_ENVIRONMENT = 'dev'
QA_ENVIRONMENT = 'qa'
PROD_ENVIRONMENT = 'prod'
TEST_ENVIRONMENT = 'test'
ENVIRONMENT = os.environ.get('ENVIRONMENT', DEV_ENVIRONMENT)

secrets_manager_client = LambdaSecretsManager(
    environment=ENVIRONMENT, service_name=APPLICATION_NAME)

delivery_tiktok_secrets_manager_client = LambdaSecretsManager(
    environment=ENVIRONMENT, service_name=SR_DELIVERY_TIKTOK_APPLICATION_NAME)


ADMIN_IDENTITY_ID = '8955b4aa-2ad0-4b0b-a2ea-6f070554d6d0'
ADMIN_PROFILE_ID = '179'
ADMIN_PROFILE_TYPE = 'ContentProfile'
ADMIN_PROFILE_ROLE = 'view_orchard_sound_recording'

S3_ACK_BUCKET = os.environ.get('S3_ACK_BUCKET', 'bytedance-s3-va-projectm-upload')
S3_ACK_PREFIXES = [
    'resso-label-us-east-16/srr-new-2/reporting/ack',
]
LIMIT = int(os.environ.get('LIMIT', '1000'))
ACK_SERVICE = os.environ.get('ACK_SERVICE', 'TikTok (Audio Fingerprinting)')

TIKTOK_AWS_ACCESS_KEY_ID = os.environ.get('TIKTOK_AWS_ACCESS_KEY_ID') if ENVIRONMENT == 'dev' \
    else secrets_manager_client.get_cred('TIKTOK_FINGERPRINT_DELIVERY_USER_NAME') if ENVIRONMENT == 'qa' \
    else delivery_tiktok_secrets_manager_client.get_cred('TIKTOK_FINGERPRINT_DELIVERY_USER_NAME')
TIKTOK_AWS_SECRET_ACCESS_KEY = os.environ.get('TIKTOK_AWS_SECRET_ACCESS_KEY') if ENVIRONMENT == 'dev' \
    else secrets_manager_client.get_cred('TIKTOK_FINGERPRINT_DELIVERY_PASSWORD') if ENVIRONMENT == 'qa' \
    else delivery_tiktok_secrets_manager_client.get_cred('TIKTOK_FINGERPRINT_DELIVERY_PASSWORD')

# ACK filter window (hours) used to select awaited records for processing.
ACKS_FILTER_AWAITED_HOURS = int(os.environ.get('ACKS_FILTER_AWAITED_HOURS', '72'))
# Age threshold (hours) after which a record is considered missing.
MISSING_HOURS_THRESHOLD = int(os.environ.get('MISSING_HOURS_THRESHOLD', '72'))
# Error substrings that indicate the platform will retry automatically; treat as awaited within the cutoff window.
AUTO_RETRY_PATTERNS = os.environ.get('AUTO_RETRY_PATTERNS', 'please wait for automatic retry').split(',')


# Credentials
private_key_bytes: typing.Optional[bytes] = None
if ENVIRONMENT in [PROD_ENVIRONMENT, QA_ENVIRONMENT]:
    secrets_manager_client = LambdaSecretsManager(
        environment=ENVIRONMENT,
        service_name=APPLICATION_NAME)
    passphrase = secrets_manager_client.get_cred('SNOWFLAKE_KEY_PASSPHRASE')
    private_key = secrets_manager_client.get_cred('SNOWFLAKE_KEY')
    private_key_bytes = bytes(private_key.strip(), 'utf-8')
else:
    snowflake_key = os.environ.get(
        'SNOWFLAKE_PRIVATE_KEY', None)
    passphrase = os.environ.get(
        'SNOWFLAKE_KEY_PASSPHRASE', None)
    private_key_bytes = bytes(snowflake_key.strip(), 'utf-8') if snowflake_key else None

if ENVIRONMENT != TEST_ENVIRONMENT and private_key_bytes is not None:
    try:
        decrypted_key: typing.Optional[bytes] = None
        passphrase_bytes = passphrase.strip().encode('utf-8') if passphrase else None
        pem_key = serialization.load_pem_private_key(
            private_key_bytes,
            password=None,
            backend=default_backend(),
        )
    except TypeError:
        passphrase_bytes = passphrase.strip().encode('utf-8') if passphrase else None
        pem_key = serialization.load_pem_private_key(
            private_key_bytes,
            password=passphrase_bytes,
            backend=default_backend(),
        )
    decrypted_key = pem_key.private_bytes(
        encoding=serialization.Encoding.DER,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption(),
    )
else:
    decrypted_key = None

# DB Connectors
SNOWFLAKE_DB_CONFIG = {
    'role': os.environ.get('SNOWFLAKE_ROLE'),
    'warehouse': os.environ.get('SNOWFLAKE_WAREHOUSE'),
    'db': os.environ.get('SNOWFLAKE_DATABASE'),
    'database': os.environ.get('SNOWFLAKE_DATABASE'),
    'schema': os.environ.get('SNOWFLAKE_SCHEMA'),
    'user': os.environ.get('SNOWFLAKE_USER'),
    'private_key': decrypted_key,
    'account': os.environ.get('SNOWFLAKE_ACCOUNT')
}