import os
import jwt
from fastapi import Request, HTTPException
from dotenv import load_dotenv

load_dotenv(override=True)

JWT_SECRET     = os.getenv("JWT_SECRET", "T1e2c3d4e5f67890")
JWT_ALGORITHM  = os.getenv("JWT_ALGORITHM", "HS256")
DEFAULT_ORG_ID = os.getenv("ORG_ID", "ae7aecba-e656-4577-b178-75db2938f040")
SKIP_EXPIRY    = os.getenv("SKIP_TOKEN_EXPIRY", "false").lower() == "true"


def get_user_and_tenant(request: Request) -> tuple:
    authorization = request.headers.get("Authorization")
    if not authorization or not authorization.startswith("Bearer "):
        raise HTTPException(status_code=401, detail="Missing Authorization header")

    token = authorization.split(" ")[1]

    secrets_to_try = list(filter(None, [
        os.getenv("JWT_SECRET", ""),
        os.getenv("JWT_SECRET_NEW", ""),
    ]))

    payload = None
    last_error = None

    for secret in secrets_to_try:
        if not secret:
            continue
        try:
            payload = jwt.decode(
                token, secret,
                algorithms=[JWT_ALGORITHM],
                options={"verify_exp": not SKIP_EXPIRY}
            )
            print(f"Auth — JWT decoded with secret: {secret[:6]}...")
            break
        except jwt.ExpiredSignatureError:
            if SKIP_EXPIRY:
                try:
                    payload = jwt.decode(
                        token, secret,
                        algorithms=[JWT_ALGORITHM],
                        options={"verify_exp": False}
                    )
                    print(f"Auth — JWT decoded (expiry skipped)")
                    break
                except Exception:
                    pass
            raise HTTPException(status_code=401, detail="Token expired — get new token from Node.js")
        except Exception as e:
            last_error = str(e)
            continue

    if not payload:
        print(f"Auth — JWT decode failed: {last_error}")
        raise HTTPException(status_code=401, detail="Invalid token")

    user_id = (
        payload.get("id") or
        payload.get("user_id") or
        payload.get("sub")
    )
    if not user_id:
        raise HTTPException(status_code=400, detail="Invalid token payload — missing user id")

    tenant_id = (
        payload.get("organization_id") or
        payload.get("tenant_id") or
        payload.get("org_id") or
        payload.get("orgId") or
        request.headers.get("X-Tenant-ID") or
        request.headers.get("X-Organization-ID") or
        DEFAULT_ORG_ID
    )

    print(f"Auth — user_id={user_id} tenant_id={tenant_id}")
    return str(user_id), str(tenant_id)


def get_user_from_token(request: Request) -> str:
    user_id, _ = get_user_and_tenant(request)
    return user_id