"""OAuth2 Confidential Client token manager for Madgicx MCP server."""
 
from __future__ import annotations
 
import logging
import os
import threading
import time
 
import requests
 
log = logging.getLogger("mcp_auth")
 
 
class MadgicxConfidentialClientAuth:
    """Thread-safe OAuth2 token manager using client_credentials grant.
 
    Token lifecycle:
      1. Valid access token  -> use it
      2. Access token expired + valid refresh token -> refresh
      3. Refresh token expired/rejected -> re-authenticate
    """
 
    def __init__(
        self,
        client_id: str | None = None,
        client_secret: str | None = None,
        token_url: str | None = None,
        scopes: str = "mcp:read mcp:write",
        expiry_buffer_seconds: int = 60,
    ):
        self.client_id = client_id or os.getenv("MADGICX_CLIENT_ID", "")
        self.client_secret = client_secret or os.getenv("MADGICX_CLIENT_SECRET", "")
        self.token_url = token_url or os.getenv("MADGICX_TOKEN_URL", "")
        self.scopes = scopes
        self.expiry_buffer = expiry_buffer_seconds
 
        self._access_token: str | None = None
        self._refresh_token: str | None = None
        self._access_token_expiry: float = 0
        self._refresh_token_expiry: float = 0
        self._lock = threading.Lock()
 
    @property
    def access_token(self) -> str:
        """Always returns a valid access token. Thread-safe."""
        with self._lock:
            now = time.time()
 
            if self._access_token and now < self._access_token_expiry - self.expiry_buffer:
                return self._access_token
 
            if self._refresh_token and now < self._refresh_token_expiry - self.expiry_buffer:
                self._do_refresh()
                return self._access_token
 
            self._do_client_credentials()
            return self._access_token
 
    @property
    def headers(self) -> dict[str, str]:
        return {"Authorization": f"Bearer {self.access_token}"}
 
    def _do_client_credentials(self) -> None:
        resp = requests.post(
            self.token_url,
            data={
                "grant_type": "client_credentials",
                "client_id": self.client_id,
                "client_secret": self.client_secret,
                "scope": self.scopes,
            },
        )
        resp.raise_for_status()
        self._store_tokens(resp.json())
 
    def _do_refresh(self) -> None:
        try:
            resp = requests.post(
                self.token_url,
                data={
                    "grant_type": "refresh_token",
                    "refresh_token": self._refresh_token,
                    "client_id": self.client_id,
                    "client_secret": self.client_secret,
                },
            )
            resp.raise_for_status()
            self._store_tokens(resp.json())
        except requests.HTTPError:
            self._do_client_credentials()
 
    def _store_tokens(self, token_response: dict) -> None:
        now = time.time()
        self._access_token = token_response["access_token"]
        self._access_token_expiry = now + token_response.get("expires_in", 3600)
 
        if "refresh_token" in token_response:
            self._refresh_token = token_response["refresh_token"]
            self._refresh_token_expiry = now + token_response.get(
                "refresh_token_expires_in", 1_209_600
            )