#!/usr/bin/env python3
"""Create an Image-2 agent token from an existing user account."""

import argparse
import getpass
import json
import os
import sys
import urllib.error
import urllib.request


DEFAULT_SCOPES = ["generate:image", "upload:reference", "read:task"]


def post_json(base_url, path, payload, token=None):
    data = json.dumps(payload).encode("utf-8")
    headers = {
        "Content-Type": "application/json",
        "Accept": "application/json",
    }
    if token:
        headers["Authorization"] = f"Bearer {token}"

    request = urllib.request.Request(
        f"{base_url.rstrip('/')}{path}",
        data=data,
        headers=headers,
        method="POST",
    )

    try:
        with urllib.request.urlopen(request, timeout=30) as response:
            return json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as error:
        body = error.read().decode("utf-8", errors="replace")
        try:
            parsed = json.loads(body)
        except json.JSONDecodeError:
            parsed = {"success": False, "message": body}
        parsed.setdefault("success", False)
        parsed.setdefault("httpStatus", error.code)
        return parsed


def parse_args():
    parser = argparse.ArgumentParser(
        description="Create an Image-2 iat_ agent token using an existing username and password."
    )
    parser.add_argument("--base-url", default=os.environ.get("IMAGE2_AGENT_BASE_URL", ""))
    parser.add_argument("--username", default=os.environ.get("IMAGE2_USERNAME", ""))
    parser.add_argument("--password", default=os.environ.get("IMAGE2_PASSWORD", ""))
    parser.add_argument("--name", default=os.environ.get("IMAGE2_AGENT_TOKEN_NAME", "codex-agent"))
    parser.add_argument(
        "--scope",
        action="append",
        dest="scopes",
        help="Token scope. Repeat for multiple scopes. Defaults to generate/upload/read task scopes.",
    )
    parser.add_argument("--expires-at", default=os.environ.get("IMAGE2_AGENT_EXPIRES_AT", ""))
    parser.add_argument("--json", action="store_true", help="Print the full JSON response.")
    parser.add_argument("--print-env", action="store_true", help="Print export commands for shell use.")
    return parser.parse_args()


def main():
    args = parse_args()

    base_url = args.base_url.strip() or input("Image-2 base URL: ").strip()
    username = args.username.strip() or input("Username: ").strip()
    password = args.password or getpass.getpass("Password: ")

    if not base_url or not username or not password:
        print("base URL, username, and password are required", file=sys.stderr)
        return 2

    login = post_json(base_url, "/user/login", {
        "username": username,
        "password": password,
    })

    if not login.get("success") or not login.get("token"):
        print(json.dumps(login, ensure_ascii=False, indent=2), file=sys.stderr)
        return 1

    payload = {
        "name": args.name,
        "scopes": args.scopes or DEFAULT_SCOPES,
    }
    if args.expires_at:
        payload["expiresAt"] = args.expires_at

    created = post_json(base_url, "/user/agent-tokens", payload, token=login["token"])

    if not created.get("success") or not created.get("data", {}).get("token"):
        print(json.dumps(created, ensure_ascii=False, indent=2), file=sys.stderr)
        return 1

    if args.json:
        print(json.dumps(created, ensure_ascii=False, indent=2))
        return 0

    token = created["data"]["token"]
    token_info = created["data"].get("tokenInfo", {})

    print("Agent token created.")
    print(f"Token id: {token_info.get('id')}")
    print(f"Token name: {token_info.get('name')}")
    print(f"Scopes: {', '.join(token_info.get('scopes', []))}")
    print()

    if args.print_env:
        print(f"export IMAGE2_AGENT_BASE_URL={json.dumps(base_url)}")
        print(f"export IMAGE2_AGENT_TOKEN={json.dumps(token)}")
    else:
        print("IMAGE2_AGENT_TOKEN:")
        print(token)

    return 0


if __name__ == "__main__":
    raise SystemExit(main())