ALwrity/backend/services/integrations/wix/auth_utils.py

"""
Authentication utilities for Wix API requests.

Supports both OAuth Bearer tokens and API keys for Wix Headless apps.
"""

import os
from typing import Dict, Optional
from loguru import logger


def get_wix_headers(
    access_token: str,
    client_id: Optional[str] = None,
    extra: Optional[Dict[str, str]] = None
) -> Dict[str, str]:
    """
    Build headers for Wix API requests with automatic token type detection.
    
    Supports:
    - OAuth Bearer tokens (JWT format: xxx.yyy.zzz)
    - Wix API keys (for Headless apps)
    
    Args:
        access_token: OAuth token OR API key
        client_id: Optional Wix client ID
        extra: Additional headers to include
        
    Returns:
        Headers dict with proper Authorization format
    """
    headers: Dict[str, str] = {
        'Content-Type': 'application/json',
    }
    
    if access_token:
        # Ensure access_token is a string (defensive check)
        if not isinstance(access_token, str):
            from services.integrations.wix.utils import normalize_token_string
            normalized = normalize_token_string(access_token)
            if normalized:
                access_token = normalized
            else:
                access_token = str(access_token)
        
        token = access_token.strip()
        if token:
            # Detect token type
            # API keys are typically longer and don't have JWT structure (xxx.yyy.zzz)
            # JWT tokens have exactly 2 dots separating 3 parts
            # Wix OAuth tokens can have format "OauthNG.JWS.xxx.yyy.zzz"
            
            # CRITICAL: Wix OAuth tokens can have format "OauthNG.JWS.xxx.yyy.zzz"
            # These should use "Bearer" prefix even though they have more than 2 dots
            if token.startswith('OauthNG.JWS.'):
                # Wix OAuth token - use Bearer prefix
                headers['Authorization'] = f'Bearer {token}'
                logger.debug("Using Wix OAuth token with Bearer prefix (OauthNG.JWS. format detected)")
            elif token.startswith('IST.'):
                # Wix Headless API key - send as-is, no Bearer
                headers['Authorization'] = token
                logger.debug("Using Wix API key for authorization (IST. format detected)")
            else:
                # Standard JWT has exactly 2 dots separating header.payload.signature
                dot_count = token.count('.')
                if dot_count == 2:
                    headers['Authorization'] = f'Bearer {token}'
                    logger.debug("Using OAuth Bearer token (JWT format: 2 dots detected)")
                else:
                    headers['Authorization'] = token
                    logger.debug("Using token as-is (non-JWT format detected)")
    
    if client_id:
        headers['wix-client-id'] = client_id
    
    if extra:
        headers.update(extra)
    
    return headers


def get_wix_api_key() -> Optional[str]:
    """
    Get Wix API key from environment.
    
    For Wix Headless apps, API keys provide admin-level access.
    
    Returns:
        API key if set, None otherwise
    """
    api_key = os.getenv('WIX_API_KEY')
    if api_key:
        logger.warning(f"✅ Wix API key found in environment ({len(api_key)} chars)")
    else:
        logger.warning("❌ No Wix API key in environment")
    return api_key


def should_use_api_key(access_token: Optional[str] = None) -> bool:
    """
    Determine if we should use API key instead of OAuth token.
    
    Use API key if:
    - No OAuth token provided
    - OAuth token is getting 403 errors
    - API key is available in environment
    
    Args:
        access_token: Optional OAuth token
        
    Returns:
        True if should use API key, False otherwise
    """
    # If no access token, check for API key
    if not access_token or not access_token.strip():
        return get_wix_api_key() is not None
    
    # If access token looks like API key already, use it
    # Ensure access_token is a string (defensive check)
    if not isinstance(access_token, str):
        from services.integrations.wix.utils import normalize_token_string
        normalized = normalize_token_string(access_token)
        if normalized:
            access_token = normalized
        else:
            access_token = str(access_token)
    
    token = access_token.strip()
    if token.startswith('OauthNG.JWS.'):
        return False
    if token.startswith('IST.'):
        return True
    # Standard JWT has exactly 2 dots
    return token.count('.') != 2