# Client minimal de l'API COVERAF pour Python 3.8+ (bibliothèque standard).
# À utiliser UNIQUEMENT côté serveur.
import hashlib
import hmac
import json
import os
import time
import urllib.error
import urllib.request

BASE_URL = os.environ.get("COVERAF_BASE_URL", "https://api.coveraf.com")
CLE_API = os.environ["COVERAF_CLE_API"]   # cvr_test_... ou cvr_live_...
SECRET = os.environ["COVERAF_SECRET"]     # cvr_sig_...


class ErreurCoveraf(Exception):
    def __init__(self, erreur, requete_id):
        super().__init__(erreur["message"])
        self.code = erreur["code"]
        self.details = erreur.get("details")
        self.requete_id = requete_id


def appel_coveraf(methode, chemin, donnees=None, idempotency_key=None):
    corps = "" if donnees is None else json.dumps(donnees, ensure_ascii=False, separators=(",", ":"))
    entetes = {"Authorization": f"Bearer {CLE_API}", "Content-Type": "application/json"}

    if methode != "GET":
        # Signature : HMAC-SHA256 de "<timestamp>.<MÉTHODE>.<chemin>.<corps>"
        timestamp = str(int(time.time()))
        message = f"{timestamp}.{methode}.{chemin}.{corps}".encode("utf-8")
        signature = hmac.new(SECRET.encode("utf-8"), message, hashlib.sha256).hexdigest()
        entetes["X-Coveraf-Timestamp"] = timestamp
        entetes["X-Coveraf-Signature"] = f"v1={signature}"
        if idempotency_key:
            entetes["Idempotency-Key"] = idempotency_key

    requete = urllib.request.Request(BASE_URL + chemin, data=corps.encode("utf-8") if corps else None, headers=entetes, method=methode)
    try:
        with urllib.request.urlopen(requete) as reponse:
            return json.loads(reponse.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        resultat = json.loads(e.read().decode("utf-8"))
        raise ErreurCoveraf(resultat["erreur"], resultat.get("requete_id"))


# Exemple :
#   devis = appel_coveraf("POST", "/v1/devis", {"offre": "securvie_500k", "donnees": {"assure": {"date_naissance": "1985-06-15"}}})