"""
This file contains the environment variables for the application, including
the Auth0 and YouTube CMS fallback credentials.
"""

from itertools import product
from os import getenv
from pathlib import Path

from dotenv import load_dotenv

from .constants import LOCALHOST

_project_root = Path(__file__).resolve().parent.parent.parent

HOST: str = getenv("HOST", LOCALHOST)
PORT: int = int(getenv("PORT", "8000"))

########################################################################################
# CORS

# Default CORS Allow Origins for local development.
_CORS_ALLOW_ORIGINS_DEFAULT = ",".join(
    f"{protocol}{domain}"
    for protocol, domain in product(
        (
            "http://",
            "https://",
        ),
        ("localhost", "127.0.0.1", "0.0.0.0"),
    )
)

# CORS Allow Origins (as a string of comma-separated values).
CORS_ALLOW_ORIGINS: tuple[str, ...] = tuple(
    getenv("CORS_ALLOW_ORIGINS", _CORS_ALLOW_ORIGINS_DEFAULT).split(",")
)

# CORS Allow Methods (as a string of comma-separated values).
CORS_ALLOW_METHODS: tuple[str, ...] = tuple(
    getenv("CORS_ALLOW_METHODS", "*").split(",")
)

# CORS Allow Headers (as a string of comma-separated values).
CORS_ALLOW_HEADERS: tuple[str, ...] = tuple(
    getenv("CORS_ALLOW_HEADERS", "*").split(",")
)

########################################################################################
# Snowflake Credentials
SNOWFLAKE_CREDENTIALS: dict[str, str] = {
    # Snowflake private key. Must be a path to the private key file, a base64-encoded
    # private key, or the private key itself as a multi-line string (wrapped with
    # -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----, with the line breaks
    # as outputted by Snowflake).
    "private_key": getenv(
        "SNOWFLAKE_PRIVATE_KEY",
        #
        Path(_project_root, "ORCHARD_YT_AUDITS.p8").resolve().as_posix(),
    ),
}

########################################################################################
# Auth0 Settings
########################################################################################

# If present, preload Auth0 environment variables from the .env file. If not present
# or a specific variable is not found, use the default values.
load_dotenv(dotenv_path=Path("security/auth0/settings.env").resolve().as_posix())

AUTH0_SETTINGS: dict[str, str] = {
    # Auth0 Management API Client ID. Example: "1234567890"
    "client_id": getenv("AUTH0_CLIENT_ID"),
    # Auth0 Client ID for the SPA frontend. Example: "FJ0FrOH5NrrLx3XzuaPfl1"
    "client_id_spa": getenv("AUTH0_SPA_CLIENT_ID", "FJ0FrOH5NrrLx3XzuaPfl1tT7Y6v4ATF"),
    # Auth0 Management API Client Secret. Example: "1234ewwe56qw321dsnj7890"
    "client_secret": getenv("AUTH0_CLIENT_SECRET"),
    # Auth0 Domain. Example: "qa-orch-youtube.us.auth0.com"
    "domain": getenv("AUTH0_DOMAIN", "qa-orch-youtube.us.auth0.com"),
    # Auth0 Audience. Example: "https://qa-orch-youtube.us.auth0.com/api/v2/"
    "audience": getenv(
        "AUTH0_AUDIENCE", "https://qa-orch-youtube.us.auth0.com/api/v2/"
    ),
    # Auth0 Issuer. Example: "https://qa-orch-youtube.us.auth0.com/"
    "issuer": getenv("AUTH0_ISSUER", "https://qa-orch-youtube.us.auth0.com/"),
    # Auth0 Algorithms. Example: "RS256"
    "algorithms": getenv("AUTH0_ALGORITHMS", "RS256"),
    # Auth0 Scope. Example: "openid offline_access profile email read:current_user"
    "scope": getenv(
        "AUTH0_SCOPE", "openid offline_access profile email read:current_user"
    ),
    # Auth0 Grant Type. Example: "client_credentials"
    "grant_type": getenv("AUTH0_GRANT_TYPE", "client_credentials"),
    "redirect_uri": getenv("AUTH0_REDIRECT_URI", f"http://{HOST}:{PORT}/callback"),
}

########################################################################################
# YT CMS Fallback Credentials
########################################################################################

# YT CMS Credentials Path. It may be provided as an environment variable or found
# in the project directory, if present (for local development). Alternatively,
# the credentials can be provided directly as environment variables using
# the YT_CMS_FALLBACK_CREDENTIALS keys. They will be used if the env var
# YTCMS_CREDENTIALS is not set and no credentials file is found.
YT_CMS_CREDENTIALS_PATH: str | None = getenv(
    "YTCMS_CREDENTIALS",
    Path(_project_root, "orchard-youtube-audit-60dc4ed72f7f.json").resolve().as_posix(),
)

YT_CMS_FALLBACK_CREDENTIALS: dict[str, str] = {
    # YT CMS Type. Example: "service_account"
    "type": getenv("YTCMS_TYPE", "service_account"),
    # YT CMS Project ID. Example: "orchard-youtube-audit"
    "project_id": getenv("YTCMS_PROJECT_ID"),
    # YT CMS Private Key ID. Example: "976efkjgwei32427..."
    "private_key_id": getenv("YTCMS_PRIVATE_KEY_ID"),
    # YT CMS Private Key. Provide it as a multiline string with the line breaks
    # (as it appears in the private key file).
    # Example: "-----BEGIN PRIVATE KEY-----\nMIIkehwekfhh..."
    "private_key": getenv("YTCMS_PRIVATE"),
    # YT CMS Client Email. Example: "client@project-id..."
    "client_email": getenv("YTCMS_CLIENT_EMAIL"),
    # YT CMS Client ID. Example: "1234567890"
    "client_id": getenv("YTCMS_CLIENT_ID"),
    # YT CMS Auth URI. Example: "https://accounts.google.com/o/oauth2/auth"
    "auth_uri": getenv("YTCMS_AUTH_URI", "https://accounts.google.com/o/oauth2/auth"),
    # YT CMS Token URI. Example: "https://oauth2.googleapis.com/token"
    "token_uri": getenv("YTCMS_TOKEN_URI", "https://oauth2.googleapis.com/token"),
    # YT CMS Auth Provider X509 Cert URL. Example: "https://www.googleapis.com/oauth2/v1/certs"
    "auth_provider_x509_cert_url": getenv(
        "YTCMS_AUTH_PROVIDER_X509_CERT_URL",
        "https://www.googleapis.com/oauth2/v1/certs",
    ),
    "client_x509_cert_url": getenv(
        "YTCMS_CLIENT_X509_CERT_URL",
        "https://www.googleapis.com/robot/v1/metadata/x509/yt-audits%40orchard-youtube-audit.iam.gserviceaccount.com",
    ),
}


########################################################################################
# MySQL Credentials
########################################################################################

MYSQL_CREDENTIALS: dict[str, str] = {
    "host": getenv("MYSQL_HOST", "localhost"),
    "port": int(getenv("MYSQL_PORT", "3306")),
    "database": getenv("MYSQL_DB", "public"),
    "user": getenv("MYSQL_USER", "root"),
    "password": getenv("MYSQL_PASSWORD", "=b*G}0A<V06%"),  # Default password for
    # local development.
}