#!/usr/bin/env python3
"""Verify Google Drive OAuth credentials are valid.

Priority:
1. DRIVE_CREDS_JSON env var — authorized_user JSON injected by Skald.
2. GOOGLE_CREDS_PATH env var → file on disk (standalone).
3. Default path ./secrets/google_creds.json (standalone).

Loads credentials and does one cheap API probe (files.list(maxResults=1)).

Output: single JSON object on stdout:
  {"ok": true, "message": "..."}
  {"ok": false, "message": "..."}
"""
from __future__ import annotations

import json
import os
import sys


def _check_api(creds) -> None:
    """Perform a live Drive API probe with the given credentials."""
    try:
        from google.auth.transport.requests import Request
        from googleapiclient.discovery import build
    except ImportError as e:
        _fail(f"Missing dependencies: {e}. Install google-api-python-client and google-auth.")
        return

    if creds.expired and creds.refresh_token:
        try:
            creds.refresh(Request())
        except Exception as e:
            _fail(f"Token refresh failed: {e}")
            return

    try:
        service = build("drive", "v3", credentials=creds)
        result = service.files().list(maxResults=1, q="trashed=false").execute()
        count = len(result.get("files", []))
        _ok(f"Google Drive API is reachable. {count} recent file(s) found.")
    except Exception as e:
        _fail(f"API probe failed: {e}")


def main() -> None:
    # Priority 1: env var with full JSON (Skald mode)
    raw = os.environ.get("DRIVE_CREDS_JSON")
    if raw:
        try:
            from google.oauth2.credentials import Credentials
            creds = Credentials.from_authorized_user_info(
                json.loads(raw),
                ["https://www.googleapis.com/auth/drive"],
            )
            _check_api(creds)
            return
        except ImportError as e:
            _fail(f"Missing dependencies: {e}. Install google-api-python-client and google-auth.")
            return
        except Exception as e:
            _fail(f"Failed to load credentials from DRIVE_CREDS_JSON: {e}")
            return

    # Priority 2/3: file-based (standalone use)
    creds_path = os.environ.get(
        "GOOGLE_CREDS_PATH",
        os.path.join(os.path.dirname(__file__), "secrets", "google_creds.json"),
    )

    if not os.path.exists(creds_path):
        _fail(f"Credentials not found. Set DRIVE_CREDS_JSON env var (Skald mode) or "
              f"place credentials file at {creds_path} (standalone mode).")
        return

    try:
        from google.oauth2.credentials import Credentials
        creds = Credentials.from_authorized_user_file(
            creds_path,
            ["https://www.googleapis.com/auth/drive"],
        )
    except ImportError as e:
        _fail(f"Missing dependencies: {e}. Install google-api-python-client and google-auth.")
        return
    except Exception as e:
        _fail(f"Failed to load credentials: {e}")
        return

    _check_api(creds)


def _ok(message: str) -> None:
    json.dump({"ok": True, "message": message}, sys.stdout)
    sys.stdout.write("\n")


def _fail(message: str) -> None:
    json.dump({"ok": False, "message": message}, sys.stdout)
    sys.stdout.write("\n")
    sys.exit(1)


if __name__ == "__main__":
    main()