"""
Mock authentication and authorization for gcplocal.

Accepts all requests regardless of credentials. Provides helpers
to generate fake OAuth2 tokens and service account metadata.
"""

import time
import uuid
from typing import Any, Dict

from flask import Request


def authenticate_request(request: Request) -> Dict[str, Any]:
    """
    Mock auth — always succeeds. Returns a fake identity context
    that services can use for audit-style fields.
    """
    auth_header = request.headers.get("Authorization", "")
    if auth_header.startswith("Bearer "):
        token = auth_header[7:]
    else:
        token = "anonymous"

    return {
        "email": "gcplocal@gcplocal.iam.gserviceaccount.com",
        "token": token,
        "authenticated": True,
    }


def generate_access_token() -> Dict[str, Any]:
    return {
        "access_token": f"ya29.gcplocal-{uuid.uuid4().hex[:24]}",
        "expires_in": 3600,
        "token_type": "Bearer",
    }


def generate_service_account_key(project: str, email: str) -> Dict[str, Any]:
    key_id = uuid.uuid4().hex[:40]
    return {
        "name": f"projects/{project}/serviceAccounts/{email}/keys/{key_id}",
        "privateKeyType": "TYPE_GOOGLE_CREDENTIALS_FILE",
        "keyAlgorithm": "KEY_ALG_RSA_2048",
        "privateKeyData": "REDACTED_FOR_LOCAL_EMULATION",
        "validAfterTime": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
        "validBeforeTime": "2030-01-01T00:00:00Z",
        "keyOrigin": "GOOGLE_PROVIDED",
        "keyType": "USER_MANAGED",
    }
