"""
Authentication module for the AI Messaging System Visualization Tool.

Handles user authentication and access control.
"""

import os
import streamlit as st
from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file in visualization directory
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)
else:
    # Try parent directory .env
    parent_env_path = Path(__file__).parent.parent.parent / '.env'
    if parent_env_path.exists():
        load_dotenv(parent_env_path)

# Authorized emails - team members only
AUTHORIZED_EMAILS = {
    "danial@musora.com",
    "danial.ebrat@gmail.com",
    "simon@musora.com",
    "una@musora.com",
    "mark@musora.com",
    "gabriel@musora.com",
    "nikki@musora.com"
}


def get_credential(key: str) -> str:
    """
    Get credential from environment variables.

    Args:
        key: Credential key

    Returns:
        str: Credential value
    """
    return os.getenv(key, "")


def get_valid_token() -> str:
    """
    Get the valid access token from environment.

    Returns:
        str: Valid access token
    """
    return get_credential("APP_TOKEN")


def verify_login(email: str, token: str) -> bool:
    """
    Verify user login credentials.

    Args:
        email: User email address
        token: Access token

    Returns:
        bool: True if credentials are valid, False otherwise
    """
    valid_token = get_valid_token()
    email_normalized = email.lower().strip()

    return (email_normalized in AUTHORIZED_EMAILS) and (token == valid_token)


def check_authentication() -> bool:
    """
    Check if user is authenticated in current session.

    Returns:
        bool: True if authenticated, False otherwise
    """
    return st.session_state.get("authenticated", False)


def get_current_user() -> str:
    """
    Get the currently logged-in user's email.

    Returns:
        str: User email or empty string if not authenticated
    """
    return st.session_state.get("user_email", "")


def logout():
    """
    Log out the current user by clearing session state.
    """
    if "authenticated" in st.session_state:
        del st.session_state["authenticated"]
    if "user_email" in st.session_state:
        del st.session_state["user_email"]