"""One-time OAuth setup: opens a browser so you can authorize your Google account.

Saves the token to credentials/token.json for reuse by the app.

Prerequisites:
  1. Go to https://console.cloud.google.com/apis/credentials
  2. Create an OAuth 2.0 Client ID (type: Desktop)
  3. Download the JSON and save it as credentials/client_secrets.json

Usage:
  python auth_setup.py
"""

import config


def main():
    from google_auth_oauthlib.flow import InstalledAppFlow

    if not config.OAUTH_CLIENT_SECRETS.exists():
        print("ERROR: credentials/client_secrets.json not found.")
        print()
        print("Create one at: https://console.cloud.google.com/apis/credentials")
        print("  -> Create Credentials -> OAuth client ID -> Desktop app")
        print("  -> Download the JSON -> save as credentials/client_secrets.json")
        return

    flow = InstalledAppFlow.from_client_secrets_file(
        str(config.OAUTH_CLIENT_SECRETS), config.GOOGLE_SCOPES
    )
    creds = flow.run_local_server(port=0)

    config.OAUTH_TOKEN_FILE.parent.mkdir(parents=True, exist_ok=True)
    config.OAUTH_TOKEN_FILE.write_text(creds.to_json())

    print(f"Token saved to {config.OAUTH_TOKEN_FILE}")
    print()
    print("For hosted deployment, set these env vars:")
    print(f"  GOOGLE_OAUTH_REFRESH_TOKEN={creds.refresh_token}")
    print(f"  GOOGLE_OAUTH_CLIENT_ID={creds.client_id}")
    print(f"  GOOGLE_OAUTH_CLIENT_SECRET={creds.client_secret}")


if __name__ == "__main__":
    main()