"""Drop this file into your product. pip install requests"""
from __future__ import annotations

import hashlib
import hmac
import json
import os
import secrets
import time
from typing import Any

import requests


class KeyguardClient:
    def __init__(self, base_url: str = "https://api.keyguard.live"):
        self.base_url = base_url.rstrip("/")
        self.session_id: str | None = None
        self.signing_key: bytes | None = None

    def init(self, app_name: str, owner_id: str, version: str | None = None, file_hash: str | None = None) -> dict[str, Any]:
        res = requests.post(
            f"{self.base_url}/api/client/v1/init",
            json={"name": app_name, "ownerId": owner_id, "ver": version, "hash": file_hash},
            timeout=20,
        )
        data = res.json()
        if not data.get("success"):
            raise RuntimeError(data.get("message") or "init failed")
        self.session_id = data["sessionid"]
        self.signing_key = __import__("base64").b64decode(data["enckey"])
        return data

    def login(self, username: str, password: str, hwid: str) -> dict[str, Any]:
        return self.dispatch("login", {"username": username, "password": password, "hwid": hwid})

    def license(self, key: str, hwid: str) -> dict[str, Any]:
        return self.dispatch("license", {"key": key, "hwid": hwid})

    def check(self) -> dict[str, Any]:
        return self.dispatch("check", {})

    def register(self, username: str, password: str, license_key: str, hwid: str) -> dict[str, Any]:
        return self.dispatch("register", {"username": username, "password": password, "key": license_key, "hwid": hwid})

    def logout(self) -> dict[str, Any]:
        return self.dispatch("logout", {})

    def change_password(self, current_password: str, new_password: str, invalidate_other_sessions: bool = True) -> dict[str, Any]:
        return self.dispatch(
            "changepassword",
            {
                "current_password": current_password,
                "new_password": new_password,
                "invalidate_other_sessions": invalidate_other_sessions,
            },
        )

    def renew(self, username: str, password: str, license_key: str) -> dict[str, Any]:
        return self.dispatch("renew", {"username": username, "password": password, "key": license_key})

    def updates(self) -> dict[str, Any]:
        return self.dispatch("updates", {})

    def file(self, file_id: str, expected_sha256: str | None = None) -> dict[str, Any]:
        data = self.dispatch("file", {"fileid": file_id})
        if not data.get("success"):
            raise RuntimeError(data.get("message") or "file failed")
        sha = str(data.get("sha256") or "").lower()
        if expected_sha256 and sha != expected_sha256.lower():
            raise RuntimeError("SHA-256 mismatch — refuse this file.")
        return data

    def dispatch(self, type: str, payload: dict[str, Any]) -> dict[str, Any]:
        if not self.session_id or not self.signing_key:
            raise RuntimeError("Call init() first")
        body = json.dumps(payload, separators=(",", ":"))
        timestamp = int(time.time())
        nonce = secrets.token_hex(8)
        canonical = f"{type}|{timestamp}|{nonce}|{self.session_id}|{body}"
        signature = hmac.new(self.signing_key, canonical.encode(), hashlib.sha256).hexdigest()
        envelope = {
            "type": type,
            "sessionid": self.session_id,
            "timestamp": timestamp,
            "nonce": nonce,
            "signature": signature,
            "payload": payload,
        }
        res = requests.post(f"{self.base_url}/api/client/v1/dispatch", json=envelope, timeout=20)
        return res.json()


if __name__ == "__main__":
    kg = KeyguardClient()
    kg.init(os.environ.get("KG_APP", "MyApp"), os.environ["KG_OWNER"])
    print(kg.license(os.environ["KG_KEY"], os.environ.get("KG_HWID", "dev-hwid")))