# pip install authlib requests

from authlib.jose import jwt as jose_jwt
from datetime import datetime, timedelta, UTC
import uuid, requests

# Load your private key (received when client was created in Admin)
with open("client-private-key.pem", "rb") as f:
    private_key = f.read()

client_id = "acme-integration"
token_endpoint = "http://api.petanque.life/auth/token"

# Sign a client assertion
now = datetime.now(UTC)
assertion = jose_jwt.encode(
    header={"alg": "ES256", "kid": "2026-04-primary"},
    payload={
        "iss": client_id,
        "sub": client_id,
        "aud": token_endpoint,
        "jti": str(uuid.uuid4()),
        "iat": int(now.timestamp()),
        "exp": int((now + timedelta(minutes=2)).timestamp()),
    },
    key=private_key,
).decode()

# Request an access token (scope = capability names)
resp = requests.post(token_endpoint, data={
    "grant_type": "client_credentials",
    "client_id": client_id,
    "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
    "client_assertion": assertion,
    "scope": "bookings:read",
})
resp.raise_for_status()
access_token = resp.json()["access_token"]

# Call the API
bookings = requests.get(
    "http://api.petanque.life/bookings",
    headers={"Authorization": f"Bearer {access_token}"},
).json()
print(f"Found {bookings['total']} bookings")

# Python (cryptography library)
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import serialization

private_key = ec.generate_private_key(ec.SECP256R1())

# Save private key (keep this secret!)
with open("client-private-key.pem", "wb") as f:
    f.write(private_key.private_bytes(
        serialization.Encoding.PEM,
        serialization.PrivateFormat.PKCS8,
        serialization.NoEncryption(),
    ))

# Save public key (register this in Admin)
with open("client-public-key.pem", "wb") as f:
    f.write(private_key.public_key().public_bytes(
        serialization.Encoding.PEM,
        serialization.SubjectPublicKeyInfo,
    ))

resp = requests.post(token_endpoint, data={
    "grant_type": "client_credentials",
    "client_id": client_id,
    "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
    "client_assertion": assertion,
    "scope": "bookings:read bookings:create",  # space-separated capabilities
})
resp.raise_for_status()
token_data = resp.json()
print(f"Token: {token_data['access_token'][:20]}...")
print(f"Type: {token_data['token_type']}")          # "Bearer"
print(f"Expires in: {token_data['expires_in']}s")    # 900
print(f"Scope: {token_data['scope']}")               # "bookings:read bookings:create"

# Error handling
if resp.status_code != 200:
    error = resp.json()
    print(f"Error: {error['error']} — {error['error_description']}")

headers = {"Authorization": f"Bearer {access_token}"}

# List bookings
bookings = requests.get(f"{base_url}/bookings", headers=headers).json()

# Create a booking
new_booking = requests.post(f"{base_url}/bookings/", headers=headers, json={
    "product_id": "64a1b2c3d4e5f6789012abcd",
    "start_time": "2026-04-01T08:00:00Z",
    "end_time": "2026-04-01T17:00:00Z",
}).json()

import time

class TokenManager:
    def __init__(self, client_id, private_key, token_endpoint):
        self.client_id = client_id
        self.private_key = private_key
        self.token_endpoint = token_endpoint
        self._token = None
        self._expires_at = 0

    def get_token(self, scope=""):
        # Refresh 60 seconds before expiry
        if self._token and time.time() < self._expires_at - 60:
            return self._token

        assertion = self._sign_assertion()
        resp = requests.post(self.token_endpoint, data={
            "grant_type": "client_credentials",
            "client_id": self.client_id,
            "client_assertion_type":
                "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
            "client_assertion": assertion,
            "scope": scope,
        })
        resp.raise_for_status()
        data = resp.json()
        self._token = data["access_token"]
        self._expires_at = time.time() + data["expires_in"]
        return self._token

    def _sign_assertion(self):
        now = datetime.now(UTC)
        return jose_jwt.encode(
            header={"alg": "ES256", "kid": "2026-04-primary"},
            payload={
                "iss": self.client_id, "sub": self.client_id,
                "aud": self.token_endpoint,
                "jti": str(uuid.uuid4()),
                "iat": int(now.timestamp()),
                "exp": int((now + timedelta(minutes=2)).timestamp()),
            },
            key=self.private_key,
        ).decode()

# Simple equality
products = api.list("products", where={"status": "active"})

# Multiple conditions (AND)
products = api.list("products", where={
    "status": "active",
    "city": "New York"
})

# Comparison operators
charges = api.list("service-charges", where={"amount": {"$gt": 500}})

# Date ranges
orders = api.list("orders", where={
    "start_time": {"$gte": "2026-04-01T00:00:00Z"},
    "end_time": {"$lte": "2026-04-30T23:59:59Z"}
})

# OR queries
orders = api.list("orders", where={
    "$or": [{"status": "active"}, {"status": "confirmed"}]
})

# Regex (case-insensitive)
products = api.list("products", where={
    "name": {"$regex": "^Prem", "$options": "i"}
})

# Newest first (default)
orders = api.list("orders", sort="-created_at")

# Sort by name ascending
products = api.list("products", sort="name")

# Multiple sort fields
orders = api.list("orders", sort="-start_time,status")

# Page through all results
page = 1
all_items = []
while True:
    result = api.list("orders", where={"status": "active"},
                      page=page, per_page=100)
    all_items.extend(result["items"])
    if page * 100 >= result["total"]:
        break
    page += 1

print(f"Fetched all {len(all_items)} orders")

# Get-then-update pattern
product, etag = api.get("products", "64a1...")

# Update with ETag
updated, new_etag = api.update("products", "64a1...", {
    "status": "maintenance"
}, etag)

# Handle conflicts
try:
    api.update("products", "64a1...", {"status": "active"}, etag)
except requests.HTTPError as e:
    if e.response.status_code == 412:
        print("Conflict! Re-fetch and retry.")
        product, etag = api.get("products", "64a1...")
    elif e.response.status_code == 428:
        print("Missing If-Match header!")

# === CREATE ===
product, etag = api.create("products", {
    "name": "Premium Suite",
    "address": "5th Avenue 12",
    "city": "New York",
    "zip_code": "10001",
    "total_items": 45,
})
product_id = product["_id"]
print(f"Created: {product['name']} ({product_id})")

# === READ ===
product, etag = api.get("products", product_id)
print(f"Status: {product['status']}")

# === UPDATE (partial) ===
product, etag = api.update("products", product_id, {
    "is_published": True,
}, etag)

# === LIST with filters ===
published = api.list("products", where={
    "is_published": True,
    "city": "New York",
})
print(f"{published['total']} published products in New York")

# === DELETE (will fail if children exist — cascade deny) ===
try:
    api.delete("products", product_id, etag)
except requests.HTTPError as e:
    if e.response.status_code == 409:
        print("Cannot delete — has related items (cascade deny)")

# Recommended error handling
try:
    product, etag = api.get("products", "nonexistent-id")
except requests.HTTPError as e:
    status = e.response.status_code
    body = e.response.json()

    if status == 401:
        print("Token expired or invalid — request a new one")
    elif status == 403:
        missing = body.get("detail", {}).get("missing", [])
        print(f"Missing capabilities: {missing}")
    elif status == 404:
        print("Not found")
    elif status == 412:
        print("ETag conflict — re-fetch and retry")
    elif status == 429:
        retry_after = e.response.headers.get("Retry-After", "60")
        print(f"Rate limited — retry after {retry_after}s")
    else:
        print(f"Error {status}: {body}")

# Respect Retry-After
import time

resp = requests.get(f"{base_url}/bookings", headers=headers)
if resp.status_code == 429:
    retry_after = int(resp.headers.get("Retry-After", 60))
    time.sleep(retry_after)
    resp = requests.get(f"{base_url}/bookings", headers=headers)

import json

# Check key status via API
resp = requests.get(f"{base_url}/api-clients/{client_id}",
                    headers=admin_headers)
client_data = resp.json()

for key in client_data.get("keys", []):
    kid = key["kid"]
    active_until = key.get("active_until")
    if active_until:
        print(f"Key {kid} expires: {active_until}")
        # Plan rotation before this date
    else:
        print(f"Key {kid} is the primary key (no expiry)")

# Best practice: load kid from config, not hardcoded
# When you deploy a new key, update your config to use the new kid