"""Ephemeral, URL-safe file-preview tokens.

Why this exists
---------------
File downloads require an ``Authorization: Bearer`` header, but a browser
cannot attach headers to the requests made by ``<iframe src>`` / ``<img
src>`` — which is what the preview modal uses. The previous workaround
fetched the bytes with ``fetch`` and rendered a local ``blob:`` URL, but
download managers (IDM et al.) hook ``blob:`` URLs, fail to resolve them
outside the originating document, and hand the browser a 0-byte file under
a bare UUID name — so the preview broke and a junk download appeared.

Instead we mint a short-lived HMAC token scoped to a single attachment and
put it in the query string, giving the iframe a *real* URL that also
carries its own authorization. The token is not a session credential: it
authorises exactly one (quote_id, kind, attachment_id) triple and expires
in minutes.

Format: ``<expiry-unix>.<hex-hmac>`` over ``"{quote_id}:{kind}:{attachment_id}:{expiry}"``.
"""

from __future__ import annotations

import hashlib
import hmac
import time
import uuid

from app.config import settings

# پیش‌نمایش کوتاه‌عمر است — فقط برای باز شدن مودال، نه اشتراک‌گذاری لینک
DEFAULT_TTL_SECONDS = 300


def _secret() -> bytes:
    """Key for the HMAC. Reuses existing secrets so no new config is needed."""
    base = (
        settings.CASDOOR_CLIENT_SECRET
        or settings.MINIO_SECRET_KEY
        or "procurement-preview-fallback"
    )
    return base.encode("utf-8")


def _sign(quote_id: uuid.UUID, kind: str, attachment_id: uuid.UUID, expiry: int) -> str:
    msg = f"{quote_id}:{kind}:{attachment_id}:{expiry}".encode("utf-8")
    return hmac.new(_secret(), msg, hashlib.sha256).hexdigest()


def make_preview_token(
    quote_id: uuid.UUID, kind: str, attachment_id: uuid.UUID, ttl: int = DEFAULT_TTL_SECONDS
) -> str:
    expiry = int(time.time()) + ttl
    return f"{expiry}.{_sign(quote_id, kind, attachment_id, expiry)}"


def verify_preview_token(
    token: str, quote_id: uuid.UUID, kind: str, attachment_id: uuid.UUID
) -> bool:
    """True when the token is well-formed, unexpired and matches this file."""
    if not token or "." not in token:
        return False
    expiry_raw, signature = token.split(".", 1)
    try:
        expiry = int(expiry_raw)
    except ValueError:
        return False
    if expiry < int(time.time()):
        return False
    expected = _sign(quote_id, kind, attachment_id, expiry)
    return hmac.compare_digest(expected, signature)