#!/usr/bin/env python3
"""
Secure Environment Setup Script for Delphi Database System

This script generates secure environment variables and creates a .env file
with strong cryptographic secrets and secure configuration.

⚠️ IMPORTANT: Run this script before deploying to production!
"""
import os
import sys
import secrets
import string
import argparse
from pathlib import Path


def generate_secure_secret_key(length: int = 32) -> str:
    """Generate a cryptographically secure secret key for JWT tokens"""
    return secrets.token_urlsafe(length)


def generate_secure_password(length: int = 16, include_symbols: bool = True) -> str:
    """Generate a cryptographically secure password"""
    alphabet = string.ascii_letters + string.digits
    if include_symbols:
        alphabet += "!@#$%^&*()-_=+[]{}|;:,.<>?"
    
    return ''.join(secrets.choice(alphabet) for _ in range(length))


def validate_cors_origins(origins: str) -> bool:
    """Validate CORS origins format"""
    if not origins:
        return False
    
    origins_list = [origin.strip() for origin in origins.split(",")]
    for origin in origins_list:
        if not origin.startswith(('http://', 'https://')):
            return False
    return True


def create_secure_env_file(project_root: Path, args: argparse.Namespace) -> None:
    """Create a secure .env file with generated secrets"""
    env_file = project_root / ".env"
    
    if env_file.exists() and not args.force:
        print(f"❌ .env file already exists at {env_file}")
        print("   Use --force to overwrite, or manually update the file")
        return
    
    # Generate secure secrets
    print("🔐 Generating secure secrets...")
    secret_key = generate_secure_secret_key(32)
    admin_password = generate_secure_password(16, include_symbols=True)
    
    # Get user input for configuration
    print("\n📝 Configuration Setup:")
    
    # Admin account
    admin_username = input(f"Admin username [{args.admin_username}]: ").strip() or args.admin_username
    admin_email = input(f"Admin email [{args.admin_email}]: ").strip() or args.admin_email
    admin_fullname = input(f"Admin full name [{args.admin_fullname}]: ").strip() or args.admin_fullname
    
    # CORS origins
    while True:
        cors_origins = input("CORS origins (comma-separated, e.g., https://app.company.com,https://www.company.com): ").strip()
        if validate_cors_origins(cors_origins):
            break
        print("❌ Invalid CORS origins. Please use full URLs starting with http:// or https://")
    
    # Production settings
    is_production = input("Is this for production? [y/N]: ").strip().lower() in ('y', 'yes')
    debug = not is_production
    secure_cookies = is_production
    
    # Database URL
    if is_production:
        database_url = input("Database URL [sqlite:///./data/delphi_database.db]: ").strip() or "sqlite:///./data/delphi_database.db"
    else:
        database_url = "sqlite:///./data/delphi_database.db"
    
    # Email settings (optional)
    setup_email = input("Configure email notifications? [y/N]: ").strip().lower() in ('y', 'yes')
    email_config = {}
    if setup_email:
        email_config = {
            'SMTP_HOST': input("SMTP host (e.g., smtp.gmail.com): ").strip(),
            'SMTP_PORT': input("SMTP port [587]: ").strip() or "587",
            'SMTP_USERNAME': input("SMTP username: ").strip(),
            'SMTP_PASSWORD': input("SMTP password: ").strip(),
            'NOTIFICATION_EMAIL_FROM': input("From email address: ").strip(),
        }
    
    # Create .env content
    env_content = f"""# =============================================================================
# DELPHI CONSULTING GROUP DATABASE SYSTEM - ENVIRONMENT VARIABLES
# =============================================================================
# 
# 🔒 GENERATED AUTOMATICALLY BY setup-secure-env.py
# Generated on: {os.popen('date').read().strip()}
# 
# ⚠️ SECURITY CRITICAL: Keep this file secure and never commit to version control
# =============================================================================

# =============================================================================
# 🔒 SECURITY SETTINGS (CRITICAL)
# =============================================================================

# 🔐 Cryptographically secure secret key for JWT tokens
SECRET_KEY={secret_key}

# 🔑 Secure admin password (save this securely!)
ADMIN_PASSWORD={admin_password}

# =============================================================================
# 🌐 CORS SETTINGS
# =============================================================================

CORS_ORIGINS={cors_origins}

# =============================================================================
# 👤 ADMIN ACCOUNT SETTINGS
# =============================================================================

ADMIN_USERNAME={admin_username}
ADMIN_EMAIL={admin_email}
ADMIN_FULLNAME={admin_fullname}

# =============================================================================
# 🗄️ DATABASE SETTINGS
# =============================================================================

DATABASE_URL={database_url}

# =============================================================================
# ⚙️ APPLICATION SETTINGS
# =============================================================================

DEBUG={str(debug).lower()}
SECURE_COOKIES={str(secure_cookies).lower()}

# JWT Token expiration (in minutes)
ACCESS_TOKEN_EXPIRE_MINUTES=240
REFRESH_TOKEN_EXPIRE_MINUTES=43200

# File paths
UPLOAD_DIR=./uploads
BACKUP_DIR=./backups

# =============================================================================
# 📝 LOGGING SETTINGS
# =============================================================================

LOG_LEVEL={'DEBUG' if debug else 'INFO'}
LOG_TO_FILE=True
LOG_ROTATION=10 MB
LOG_RETENTION=30 days

# =============================================================================
# 📧 NOTIFICATION SETTINGS
# =============================================================================

NOTIFICATIONS_ENABLED={str(setup_email).lower()}
"""

    # Add email configuration if provided
    if setup_email and email_config:
        env_content += f"""
# Email SMTP settings
SMTP_HOST={email_config.get('SMTP_HOST', '')}
SMTP_PORT={email_config.get('SMTP_PORT', '587')}
SMTP_USERNAME={email_config.get('SMTP_USERNAME', '')}
SMTP_PASSWORD={email_config.get('SMTP_PASSWORD', '')}
SMTP_STARTTLS=True
NOTIFICATION_EMAIL_FROM={email_config.get('NOTIFICATION_EMAIL_FROM', '')}
"""

    env_content += """
# =============================================================================
# 🚨 SECURITY CHECKLIST - VERIFY BEFORE PRODUCTION
# =============================================================================
# 
# ✅ SECRET_KEY is 32+ character random string
# ✅ ADMIN_PASSWORD is strong and securely stored
# ✅ CORS_ORIGINS set to specific production domains
# ✅ DEBUG=False for production
# ✅ SECURE_COOKIES=True for production HTTPS
# ✅ Database backups configured and tested
# ✅ This .env file is never committed to version control
# ✅ File permissions are restrictive (600)
# 
# =============================================================================
"""

    # Write .env file
    try:
        with open(env_file, 'w') as f:
            f.write(env_content)
        
        # Set restrictive permissions (owner read/write only)
        os.chmod(env_file, 0o600)
        
        print(f"\n✅ Successfully created secure .env file at {env_file}")
        print(f"✅ File permissions set to 600 (owner read/write only)")
        
        # Display generated credentials
        print(f"\n🔑 **SAVE THESE CREDENTIALS SECURELY:**")
        print(f"   Admin Username: {admin_username}")
        print(f"   Admin Password: {admin_password}")
        print(f"   Secret Key: {secret_key[:10]}... (truncated for security)")
        
        print(f"\n⚠️  **IMPORTANT SECURITY NOTES:**")
        print(f"   • Save the admin credentials in a secure password manager")
        print(f"   • Never commit the .env file to version control")
        print(f"   • Regularly rotate the SECRET_KEY and admin password")
        print(f"   • Use HTTPS in production with SECURE_COOKIES=True")
        
        if is_production:
            print(f"\n🚀 **PRODUCTION DEPLOYMENT CHECKLIST:**")
            print(f"   • Database backups configured and tested")
            print(f"   • Monitoring and alerting configured")
            print(f"   • Security audit completed")
            print(f"   • HTTPS enabled with valid certificates")
            print(f"   • Rate limiting configured")
            print(f"   • Log monitoring configured")
            
    except Exception as e:
        print(f"❌ Error creating .env file: {e}")
        sys.exit(1)


def main():
    parser = argparse.ArgumentParser(
        description="Generate secure environment configuration for Delphi Database System"
    )
    parser.add_argument(
        "--force", 
        action="store_true", 
        help="Overwrite existing .env file"
    )
    parser.add_argument(
        "--admin-username", 
        default="admin", 
        help="Default admin username"
    )
    parser.add_argument(
        "--admin-email", 
        default="admin@yourcompany.com", 
        help="Default admin email"
    )
    parser.add_argument(
        "--admin-fullname", 
        default="System Administrator", 
        help="Default admin full name"
    )
    
    args = parser.parse_args()
    
    # Find project root
    script_dir = Path(__file__).parent
    project_root = script_dir.parent
    
    print("🔐 Delphi Database System - Secure Environment Setup")
    print("=" * 60)
    print(f"Project root: {project_root}")
    
    # Verify we're in the right directory
    if not (project_root / "app" / "main.py").exists():
        print("❌ Error: Could not find Delphi Database System files")
        print("   Make sure you're running this script from the project directory")
        sys.exit(1)
    
    create_secure_env_file(project_root, args)
    
    print(f"\n🎉 Setup complete! You can now start the application with:")
    print(f"   python -m uvicorn app.main:app --reload")


if __name__ == "__main__":
    main()