import hashlib
import hmac
from typing import Any

from pydantic import (
    BaseModel,
    ConfigDict,
    EmailStr,
    Field,
    TypeAdapter,
    computed_field,
    field_validator,
    model_validator,
)

from jb.config import settings


def email_to_product_user_id(email: str) -> str:
    """Return a deterministic, non-reversible product user ID for an email.

    The same normalized email and secret salt always produce the same ID. Keep
    the salt private and stable; changing it changes every generated ID.
    """
    salt_bytes = settings.magic_token_salt.get_secret_value().encode("utf-8")
    if len(salt_bytes) < 32:
        raise ValueError("salt must be at least 32 bytes")

    if not email.isascii():
        raise ValueError("email must contain ASCII characters only")

    normalized_email = str(TypeAdapter(EmailStr).validate_python(email)).lower()
    return hmac.new(
        key=salt_bytes,
        msg=normalized_email.encode("utf-8"),
        digestmod=hashlib.sha1,
    ).hexdigest()


class User(BaseModel):
    """A user that has been authenticated and exists in THL"""

    email: EmailStr = Field()

    display_name: str | None = Field(default=None, max_length=255)

    @field_validator("email", mode="before")
    @classmethod
    def normalize_email(cls, value: Any) -> Any:
        if not isinstance(value, str):
            return value
        if not value.isascii():
            raise ValueError("email must contain ASCII characters only")
        return value.lower()

    @model_validator(mode="before")
    @classmethod
    def validate_product_user_id(cls, data: Any) -> Any:
        if not isinstance(data, dict) or "product_user_id" not in data:
            return data

        provided_id = data["product_user_id"]
        email = data.get("email")
        if email is None:
            return data

        expected_id = email_to_product_user_id(str(email))
        if not isinstance(provided_id, str) or not hmac.compare_digest(
            provided_id, expected_id
        ):
            raise ValueError(
                f"product_user_id {provided_id} does not match email {email}"
            )

        # The computed field is authoritative; do not retain the input value.
        validated_data = dict(data)
        validated_data.pop("product_user_id")
        return validated_data

    @computed_field
    @property
    def product_user_id(self) -> str:
        return email_to_product_user_id(self.email)


class AccountLogin(BaseModel):
    # There is no practical difference between an Account "login" and "create"
    email: EmailStr = Field()


class MagicLinkExchangeRequest(BaseModel):
    model_config = ConfigDict(extra="forbid")

    token: str = Field(min_length=1)


class AmtAccountLink(BaseModel):
    model_config = ConfigDict(extra="forbid")

    email: EmailStr
    amt_worker_id: str = Field(min_length=3, max_length=50)


class SessionResponse(BaseModel):
    session_token: str
    token_type: str = "bearer"
    expires_in: int