from minio import Minio
import os
import hashlib
import subprocess
import json

MINIO_URL = "minio.lab.leadwire.dev"
MINIO_CONSOLE_URL = "https://minio-console.lab.leadwire.dev"
ADMIN_KEY = "admin"
ADMIN_SECRET = "Minio@Leadwire2026!"
MC_ALIAS = "minio-local"

mc = Minio(
    MINIO_URL,
    access_key=ADMIN_KEY,
    secret_key=ADMIN_SECRET,
    secure=True,
    cert_check=False
)

def generate_password(username: str) -> str:
    seed = f"datalab-{username}-2026"
    return hashlib.sha256(seed.encode()).hexdigest()[:16]

def mc_cmd(*args):
    cmd = ["mc", "--insecure"] + list(args)
    result = subprocess.run(cmd, capture_output=True, text=True)
    print(f"mc {' '.join(args)}: code={result.returncode} out={result.stdout.strip()} err={result.stderr.strip()}")
    return result.returncode == 0

def ensure_bucket(username):
    bucket = f"user-{username}"
    password = generate_password(username)
    try:
        # Créer le bucket
        if not mc.bucket_exists(bucket):
            mc.make_bucket(bucket)
            print(f"Bucket {bucket} créé")

        # Créer le user MinIO
        mc_cmd("admin", "user", "add", MC_ALIAS, username, password)

        # Créer la policy
        policy = json.dumps({
            "Version": "2012-10-17",
            "Statement": [{
                "Effect": "Allow",
                "Action": ["s3:*"],
                "Resource": [
                    f"arn:aws:s3:::{bucket}",
                    f"arn:aws:s3:::{bucket}/*"
                ]
            }]
        })
        policy_file = f"/tmp/policy-{username}.json"
        with open(policy_file, "w") as f:
            f.write(policy)

        mc_cmd("admin", "policy", "create", MC_ALIAS, f"policy-{username}", policy_file)
        mc_cmd("admin", "policy", "attach", MC_ALIAS, f"policy-{username}", "--user", username)

        print(f"User MinIO {username} configuré ✅")
    except Exception as e:
        print(f"MinIO error: {e}")

def get_minio_credentials(username: str) -> dict:
    return {
        "url": MINIO_CONSOLE_URL,
        "bucket": f"user-{username}",
        "access_key": username,
        "secret_key": generate_password(username)
    }