"""
Per-user platform API keys.
Allows each user to store their own API keys for external services.
Keys are stored encrypted (base64 obfuscation for now; upgrade to Fernet in production).
"""
from datetime import datetime
from app.extensions import db
import base64


# Platform definitions
# admin_only=True  → visible only to admins (API keys for system services)
# admin_only=False → visible to regular users (social media accounts)
PLATFORM_REGISTRY = {
    # ── User Social Media Accounts ──
    "twitter": {
        "name_ar": "تويتر / X",
        "name_en": "Twitter / X",
        "icon": "𝕏",
        "placeholder": "اسم المستخدم",
        "help_url": "https://x.com",
        "fields": ["api_key", "secret_key"],
        "field_labels": {"api_key": "API Key", "secret_key": "API Secret"},
        "admin_only": False,
    },
    "instagram": {
        "name_ar": "انستقرام",
        "name_en": "Instagram",
        "icon": "📸",
        "placeholder": "Access Token",
        "help_url": "https://developers.facebook.com/",
        "fields": ["api_key"],
        "field_labels": {"api_key": "Access Token"},
        "admin_only": False,
    },
    "facebook": {
        "name_ar": "فيسبوك",
        "name_en": "Facebook",
        "icon": "📘",
        "placeholder": "Page Access Token",
        "help_url": "https://developers.facebook.com/",
        "fields": ["api_key"],
        "field_labels": {"api_key": "Page Access Token"},
        "admin_only": False,
    },
    "linkedin": {
        "name_ar": "لينكدإن",
        "name_en": "LinkedIn",
        "icon": "💼",
        "placeholder": "Access Token",
        "help_url": "https://www.linkedin.com/developers/",
        "fields": ["api_key"],
        "field_labels": {"api_key": "Access Token"},
        "admin_only": False,
    },
    "tiktok": {
        "name_ar": "تيك توك",
        "name_en": "TikTok",
        "icon": "🎵",
        "placeholder": "Access Token",
        "help_url": "https://developers.tiktok.com/",
        "fields": ["api_key"],
        "field_labels": {"api_key": "Access Token"},
        "admin_only": False,
    },
    "snapchat": {
        "name_ar": "سناب شات",
        "name_en": "Snapchat",
        "icon": "👻",
        "placeholder": "Access Token",
        "help_url": "https://developers.snap.com/",
        "fields": ["api_key"],
        "field_labels": {"api_key": "Access Token"},
        "admin_only": False,
    },
    # ── Admin-Only API Keys ──
    "openai": {
        "name_ar": "OpenAI",
        "name_en": "OpenAI",
        "icon": "🤖",
        "placeholder": "sk-...",
        "help_url": "https://platform.openai.com/api-keys",
        "fields": ["api_key"],
        "admin_only": True,
    },
    "anthropic": {
        "name_ar": "Anthropic (Claude)",
        "name_en": "Anthropic (Claude)",
        "icon": "🧠",
        "placeholder": "sk-ant-...",
        "help_url": "https://console.anthropic.com/settings/keys",
        "fields": ["api_key"],
        "admin_only": True,
    },
    "google_gemini": {
        "name_ar": "Google Gemini",
        "name_en": "Google Gemini",
        "icon": "💎",
        "placeholder": "AIza...",
        "help_url": "https://aistudio.google.com/app/apikey",
        "fields": ["api_key"],
        "admin_only": True,
    },
    "stripe": {
        "name_ar": "Stripe (الدفع)",
        "name_en": "Stripe (Payments)",
        "icon": "💳",
        "placeholder": "sk_live_...",
        "help_url": "https://dashboard.stripe.com/apikeys",
        "fields": ["api_key", "publishable_key"],
        "admin_only": True,
    },
    "gamma": {
        "name_ar": "Gamma (عروض تقديمية)",
        "name_en": "Gamma (Presentations)",
        "icon": "📊",
        "placeholder": "gamma_...",
        "help_url": "https://gamma.app",
        "fields": ["api_key"],
        "admin_only": True,
    },
    "wathq": {
        "name_ar": "واثق (بيانات الشركات)",
        "name_en": "Wathq (Company Data)",
        "icon": "🏢",
        "placeholder": "wathq_...",
        "help_url": "https://wathq.sa",
        "fields": ["api_key"],
        "admin_only": True,
    },
    "kling": {
        "name_ar": "Kling AI (فيديو)",
        "name_en": "Kling AI (Video)",
        "icon": "🎬",
        "placeholder": "access key",
        "help_url": "https://klingai.com/global/dev/pricing",
        "fields": ["access_key", "secret_key"],
        "admin_only": True,
    },
    "runway": {
        "name_ar": "Runway ML (فيديو)",
        "name_en": "Runway ML (Video)",
        "icon": "🎥",
        "placeholder": "runway_...",
        "help_url": "https://dev.runwayml.com/",
        "fields": ["api_key"],
        "admin_only": True,
    },
    "pika": {
        "name_ar": "Pika Labs (فيديو)",
        "name_en": "Pika Labs (Video)",
        "icon": "⚡",
        "placeholder": "pika_...",
        "help_url": "https://pika.art",
        "fields": ["api_key"],
        "admin_only": True,
    },
    "fal": {
        "name_ar": "fal.ai (صور/فيديو)",
        "name_en": "fal.ai (Images/Video)",
        "icon": "🖼️",
        "placeholder": "fal_...",
        "help_url": "https://fal.ai/dashboard/keys",
        "fields": ["api_key"],
        "admin_only": True,
    },
}


def _encode(value):
    """Simple obfuscation. Replace with Fernet encryption in production."""
    if not value:
        return ""
    return base64.b64encode(value.encode("utf-8")).decode("ascii")


def _decode(value):
    if not value:
        return ""
    try:
        return base64.b64decode(value.encode("ascii")).decode("utf-8")
    except Exception:
        return value


class UserPlatformKey(db.Model):
    __tablename__ = "user_platform_keys"
    __table_args__ = (
        db.UniqueConstraint("user_id", "platform", name="uq_user_platform"),
    )

    id = db.Column(db.Integer, primary_key=True)
    user_id = db.Column(db.Integer, db.ForeignKey("users.id"), nullable=False)
    platform = db.Column(db.String(50), nullable=False, index=True)
    api_key_enc = db.Column(db.Text, nullable=True)
    secret_key_enc = db.Column(db.Text, nullable=True)
    publishable_key_enc = db.Column(db.Text, nullable=True)
    access_key_enc = db.Column(db.Text, nullable=True)
    is_active = db.Column(db.Boolean, default=True)
    created_at = db.Column(db.DateTime, default=datetime.utcnow)
    updated_at = db.Column(db.DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)

    user = db.relationship("User", backref=db.backref("platform_keys", lazy="dynamic"))

    # ── Getters / Setters ──
    @property
    def api_key(self):
        return _decode(self.api_key_enc)

    @api_key.setter
    def api_key(self, value):
        self.api_key_enc = _encode(value)

    @property
    def secret_key(self):
        return _decode(self.secret_key_enc)

    @secret_key.setter
    def secret_key(self, value):
        self.secret_key_enc = _encode(value)

    @property
    def publishable_key(self):
        return _decode(self.publishable_key_enc)

    @publishable_key.setter
    def publishable_key(self, value):
        self.publishable_key_enc = _encode(value)

    @property
    def access_key(self):
        return _decode(self.access_key_enc)

    @access_key.setter
    def access_key(self, value):
        self.access_key_enc = _encode(value)

    def mask(self, field="api_key"):
        """Return masked version of a key for display."""
        val = getattr(self, field, "")
        if not val or len(val) < 8:
            return "••••••••"
        return val[:4] + "•" * (len(val) - 8) + val[-4:]


def get_user_key(user_id, platform, field="api_key"):
    """Get a user's API key for a platform, or None."""
    pk = UserPlatformKey.query.filter_by(
        user_id=user_id, platform=platform, is_active=True
    ).first()
    if pk:
        return getattr(pk, field, None)
    return None


def get_effective_key(user_id, platform, field="api_key", config_key=None):
    """Get user key first, fall back to system config key."""
    user_val = get_user_key(user_id, platform, field)
    if user_val:
        return user_val
    if config_key:
        from flask import current_app
        return current_app.config.get(config_key, "")
    return ""