#!/usr/bin/env python3
"""One-time OAuth token exchange for Gmail API access.

Usage:
    1. Download OAuth client JSON from Google Cloud Console
    2. Run: python scripts/get_gmail_token.py --client-secrets-file path/to/client_secret.json
    3. Authorize as adam@seahavenind.com in the browser
    4. Copy the output JSON into Secrets Manager:
       aws secretsmanager create-secret --name exec-aide/gmail-oauth --secret-string '<json>'
"""
import argparse
import json

from google_auth_oauthlib.flow import InstalledAppFlow

SCOPES = [
    "https://www.googleapis.com/auth/gmail.readonly",
    "https://www.googleapis.com/auth/calendar",
]


def main():
    parser = argparse.ArgumentParser(description="Get Gmail OAuth refresh token")
    parser.add_argument(
        "--client-secrets-file",
        required=True,
        help="Path to the OAuth client secrets JSON downloaded from Google Cloud Console",
    )
    args = parser.parse_args()

    flow = InstalledAppFlow.from_client_secrets_file(args.client_secrets_file, SCOPES)
    creds = flow.run_local_server(port=8080)

    secret = {
        "client_id": creds.client_id,
        "client_secret": creds.client_secret,
        "refresh_token": creds.refresh_token,
        "access_token": creds.token,
        "token_expiry": creds.expiry.isoformat() if creds.expiry else "",
    }

    print("\nStore this in Secrets Manager as exec-aide/gmail-oauth:\n")
    print(json.dumps(secret, indent=2))
    print(
        "\nCommand:\n"
        f"aws secretsmanager create-secret --name exec-aide/gmail-oauth "
        f"--secret-string '{json.dumps(secret)}'"
    )


if __name__ == "__main__":
    main()