#!/usr/bin/env python3
"""Print a Cloudflare Access token for authenticated tunnel access."""

"""
mkdir -p ~/.local/bin
vim ~/.local/bin/cftoken.py
chmod +x ~/.local/bin/cftoken.py
echo 'export PATH="$PATH:/Users/hulto/.local/bin/"' >> ~/.zshrc
"""


import shutil
import subprocess
import sys

HOSTNAME = "coder.astral-labs.work"


def die(msg: str, code: int = 1) -> None:
    print(f"error: {msg}", file=sys.stderr)
    sys.exit(code)


def require_cloudflared() -> str:
    path = shutil.which("cloudflared")
    if not path:
        die("cloudflared is not installed or not on PATH")
    return path


LOGIN_REQUIRED_MARKER = (
    "Unable to find token for provided application. "
    "Please run login command to generate token"
)


def fetch_token(cloudflared: str) -> str:
    try:
        result = subprocess.run(
            [cloudflared, "access", "token", HOSTNAME],
            capture_output=True,
            text=True,
            check=True,
        )
    except subprocess.CalledProcessError as e:
        output = ((e.stdout or "") + (e.stderr or "")).strip()
        if LOGIN_REQUIRED_MARKER not in output:
            die(f"cloudflared access token failed: {output or e}")
        try:
            subprocess.run(
                [cloudflared, "access", "login", HOSTNAME],
                stdout=subprocess.DEVNULL,
                stderr=sys.stderr,
                text=True,
                check=True,
                timeout=60,
            )
        except subprocess.TimeoutExpired:
            die("cloudflared access login timed out after 60 seconds")
        except subprocess.CalledProcessError as login_err:
            die(f"cloudflared access login failed: {login_err}")
        try:
            result = subprocess.run(
                [cloudflared, "access", "token", HOSTNAME],
                capture_output=True,
                text=True,
                check=True,
            )
        except subprocess.CalledProcessError as retry_err:
            retry_output = ((retry_err.stdout or "") + (retry_err.stderr or "")).strip()
            die(
                f"cloudflared access token failed after login: {retry_output or retry_err}"
            )
    return result.stdout.strip()


def main() -> None:
    cloudflared = require_cloudflared()
    token = fetch_token(cloudflared)
    print(f"cf-access-token={token}")


if __name__ == "__main__":
    main()