import requests

from google.oauth2 import id_token
from google.auth.transport import requests as google_requests

from product_staging.config import GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET


def auth_code_exchange(auth_code: str) -> tuple[str, str, str]:
    """Retrieve a Google access token and refresh token from an auth code"""
    url = "https://oauth2.googleapis.com/token"
    body = {
        "code": auth_code,
        "client_id": GOOGLE_CLIENT_ID,
        "client_secret": GOOGLE_CLIENT_SECRET,
        "redirect_uri": "postmessage",
        "grant_type": "authorization_code",
    }

    response = requests.post(url, json=body)
    response.raise_for_status()
    response_obj = response.json()

    id_token = response_obj.get("id_token")
    decoded_token = verify_id_token(id_token)
    user_id = str(decoded_token.get("sub"))

    return (
        str(response_obj.get("access_token")),
        str(response_obj.get("refresh_token")),
        user_id,
    )


def verify_id_token(token):
    request = google_requests.Request()
    idinfo = id_token.verify_oauth2_token(token, request, audience=GOOGLE_CLIENT_ID)
    return idinfo


def generate_access_token(refresh_token: str) -> str:
    """Generate a new Google access token from a refresh token"""
    url = "https://oauth2.googleapis.com/token"
    body = {
        "client_id": GOOGLE_CLIENT_ID,
        "client_secret": GOOGLE_CLIENT_SECRET,
        "refresh_token": refresh_token,
        "grant_type": "refresh_token",
    }

    response = requests.post(url, json=body)
    response.raise_for_status()
    response_obj = response.json()
    return str(response_obj.get("access_token"))