#!/usr/bin/env python3
"""Exchange an OAuth code for a token and save it."""
import json, os, sys, urllib.parse, urllib.request

WORKSPACE = os.environ.get('WORKSPACE', '/root/.openclaw/workspace')
GOOGLE_AUTH_DIR = os.path.join(WORKSPACE, 'google-auth')
CREDENTIALS_FILE = os.path.join(GOOGLE_AUTH_DIR, 'credentials.json')
TOKEN_FILE = os.path.join(GOOGLE_AUTH_DIR, 'token-personal.json')

SCOPES = [
    'https://www.googleapis.com/auth/gmail.modify',
    'https://www.googleapis.com/auth/calendar.readonly',
]

def main():
    code = sys.argv[1] if len(sys.argv) > 1 else input("Paste auth code: ").strip()
    redirect_uri = sys.argv[2] if len(sys.argv) > 2 else 'http://localhost:8888'

    with open(CREDENTIALS_FILE) as f:
        cred = json.load(f).get('installed', {})

    client_id = cred['client_id']
    client_secret = cred['client_secret']

    token_data = urllib.parse.urlencode({
        'code': code,
        'client_id': client_id,
        'client_secret': client_secret,
        'redirect_uri': redirect_uri,
        'grant_type': 'authorization_code',
    }).encode()

    req = urllib.request.Request('https://oauth2.googleapis.com/token', data=token_data)
    try:
        resp = urllib.request.urlopen(req)
        tokens = json.loads(resp.read())
    except urllib.error.HTTPError as e:
        print(f"ERROR: {e.read().decode()}")
        sys.exit(1)

    save_data = {
        'token': tokens['access_token'],
        'access_token': tokens['access_token'],
        'refresh_token': tokens.get('refresh_token', ''),
        'token_uri': 'https://oauth2.googleapis.com/token',
        'client_id': client_id,
        'client_secret': client_secret,
        'scopes': SCOPES,
    }

    with open(TOKEN_FILE, 'w') as f:
        json.dump(save_data, f, indent=2)
    os.chmod(TOKEN_FILE, 0o600)
    print(f"✅ Token saved. Refresh token: {'YES' if save_data['refresh_token'] else 'NO'}")

if __name__ == '__main__':
    main()