from fastapi import FastAPI, HTTPException, Depends, Security
from fastapi.security import OAuth2AuthorizationCodeBearer, SecurityScopes
from fastapi.middleware.cors import CORSMiddleware
from pydantic import BaseModel
from google.oauth2 import id_token
from google.auth.transport import requests
import google.auth.transport.requests
import google.oauth2.credentials
from jose import JWTError, jwt
from datetime import datetime, timedelta
import os

app = FastAPI()

# CORSミドルウェアを追加
app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],  # 本番環境では適切に設定してください
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

# 環境変数から秘密鍵を取得（本番環境では適切に管理してください）
SECRET_KEY = os.getenv("SECRET_KEY", "your-secret-key")
ALGORITHM = "HS256"
ACCESS_TOKEN_EXPIRE_MINUTES = 30

CLIENT_ID = "YOUR_GOOGLE_CLIENT_ID.apps.googleusercontent.com"
CLIENT_SECRET = "YOUR_GOOGLE_CLIENT_SECRET"

oauth2_scheme = OAuth2AuthorizationCodeBearer(
    authorizationUrl="authorize",
    tokenUrl="token",
)

class GoogleAuthRequest(BaseModel):
    code: str

class Token(BaseModel):
    access_token: str
    token_type: str

class UserInfo(BaseModel):
    email: str
    name: str
    picture: str

def create_access_token(data: dict, expires_delta: timedelta = None):
    to_encode = data.copy()
    if expires_delta:
        expire = datetime.utcnow() + expires_delta
    else:
        expire = datetime.utcnow() + timedelta(minutes=15)
    to_encode.update({"exp": expire})
    encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
    return encoded_jwt

async def get_current_user(security_scopes: SecurityScopes, token: str = Depends(oauth2_scheme)):
    if security_scopes.scopes:
        authenticate_value = f'Bearer scope="{security_scopes.scope_str}"'
    else:
        authenticate_value = "Bearer"
    credentials_exception = HTTPException(
        status_code=401,
        detail="Could not validate credentials",
        headers={"WWW-Authenticate": authenticate_value},
    )
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        email: str = payload.get("sub")
        if email is None:
            raise credentials_exception
    except JWTError:
        raise credentials_exception
    return email

@app.post("/auth/google", response_model=Token)
async def google_auth(request: GoogleAuthRequest):
    try:
        # 認証コードを使ってトークンを取得
        flow = google.auth.transport.requests.Request()
        credentials = google.oauth2.credentials.Credentials.from_authorization_code(
            request.code,
            client_id=CLIENT_ID,
            client_secret=CLIENT_SECRET,
            scopes=['https://www.googleapis.com/auth/userinfo.email', 'https://www.googleapis.com/auth/userinfo.profile'],
            redirect_uri='postmessage'
        )

        # IDトークンを検証し、ユーザー情報を取得
        id_info = id_token.verify_oauth2_token(
            credentials.id_token, requests.Request(), CLIENT_ID)

        # JWTトークンを生成
        access_token_expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
        access_token = create_access_token(
            data={"sub": id_info["email"]}, expires_delta=access_token_expires
        )
        return {"access_token": access_token, "token_type": "bearer"}

    except Exception as e:
        raise HTTPException(status_code=400, detail=str(e))

@app.get("/protected", response_model=UserInfo)
async def protected_route(current_user: str = Depends(get_current_user)):
    # この関数は認証されたユーザーのみがアクセスできます
    # 実際のアプリケーションでは、ここでユーザー情報をデータベースから取得するなどの処理を行います
    return UserInfo(email=current_user, name="Sample User", picture="https://example.com/sample.jpg")

if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.