#!/usr/bin/python3
import sys
import os
import base64
import json
import datetime
import pytz
import time
import jwt
import m3u8

# Add parent directory to path for o11 import
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
import o11

from pywidevine.cdm import Cdm
from pywidevine.device import Device
from pywidevine.pssh import PSSH

# Parse command line parameters
user = o11.parse_params(sys.argv, 'user')
password = o11.parse_params(sys.argv, 'password')
device = o11.parse_params(sys.argv, 'device')
pin = o11.parse_params(sys.argv, 'pin')

id = o11.parse_params(sys.argv, 'id')
action = o11.parse_params(sys.argv, 'action')

bind = o11.parse_params(sys.argv, 'bind')
proxy = o11.parse_params(sys.argv, 'proxy')
doh = o11.parse_params(sys.argv, 'doh')
worker = o11.parse_params(sys.argv, 'worker')

cdm = o11.parse_params(sys.argv, 'cdm')
drm = o11.parse_params(sys.argv, 'drm')
kid = o11.parse_params(sys.argv, 'kid')
pssh = o11.parse_params(sys.argv, 'pssh')
challenge = o11.parse_params(sys.argv, 'challenge')

heartbeaturl = o11.parse_params(sys.argv, 'heartbeaturl')
heartbeatparams = o11.parse_params(sys.argv, 'heartbeatparams')

# Session setup
o11Session = o11.session(bind=bind, proxy=proxy, worker=worker)
req = o11Session.get_session()
if doh != "":
    o11.dns(doh)

if challenge == "cert":
    challenge = "CAQ="

# Configuration
WVD_PATH = './WVD.wvd'
authFile = '/Optus_auth.json'
tokenFile = '/Optus_token.txt'
SCRIPT_DIR = os.path.abspath(os.path.dirname(__file__))

USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36'

headers = {
    'accept': 'application/json, text/plain, */*',
    'origin': 'https://sport.optus.com.au',
    'referer': 'https://sport.optus.com.au/',
    'user-agent': USER_AGENT,
}

token = ''
decoded = {}

def get_auth():
    try:
        return json.load(open(SCRIPT_DIR + authFile))
    except:
        return None

def save_auth(auth_data):
    json.dump(auth_data, open(SCRIPT_DIR + authFile, 'w'), indent=2)

def get_saved_token():
    try:
        with open(SCRIPT_DIR + tokenFile, 'r') as f:
            return f.read().strip()
    except:
        return None

def save_token(tok):
    with open(SCRIPT_DIR + tokenFile, 'w') as f:
        f.write(tok)

def do_login(username, pwd):
    login_headers = {
        'Accept': 'application/json, text/plain, */*',
        'Content-Type': 'application/json; charset=UTF-8',
        'Referer': 'https://sport.optus.com.au/',
        'User-Agent': USER_AGENT,
    }
    json_data = {'password': pwd, 'username': username, 'rememberMe': 'true'}
    response = req.post('https://api-cdn.optussport.tv/api/userauth/login', headers=login_headers, json=json_data)
    try:
        return response.json()['result']['IdToken']
    except:
        return None

def login():
    global token, decoded
    print("logging in...", file=sys.stderr)
    
    auth = get_auth()
    if not auth or 'username' not in auth:
        print("No auth found. Please add Optus credentials to auth file.", file=sys.stderr)
        save_auth({'username': 'YOUR_USERNAME', 'password': 'YOUR_PASSWORD'})
        sys.exit(1)
    
    saved_tok = get_saved_token()
    if saved_tok:
        try:
            dec = jwt.decode(saved_tok, options={"verify_signature": False})
            if dec['exp'] > round(time.time()):
                token = saved_tok
                decoded = dec
                print("logged in successfully (cached token)", file=sys.stderr)
                return token
        except:
            pass
    
    tok = do_login(auth['username'], auth['password'])
    if tok:
        save_token(tok)
        token = tok
        decoded = jwt.decode(tok, options={"verify_signature": False})
        print("logged in successfully", file=sys.stderr)
        return tok
    else:
        print("Login failed", file=sys.stderr)
        sys.exit(1)

def get_token():
    global token, decoded
    if token:
        return token
    return login()

def get_pssh_from_hls(url):
    response = req.get(url, headers=headers)
    try:
        pssh_list = []
        manifest = m3u8.loads(response.text)
        inner_one = manifest.playlists[0].uri
        
        if not inner_one.startswith('http'):
            tmp = url.split('/')
            tmp.pop()
            inner_one = '/'.join(tmp) + '/' + inner_one
        
        response = req.get(inner_one, headers=headers)
        inner_manifest = m3u8.loads(response.text)
        
        for key in inner_manifest.keys:
            if key and key.keyformat and key.keyformat.lower() == 'urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed':
                pssh_list.append(key.uri.split(',')[-1])
        
        return pssh_list if pssh_list else None
    except:
        return None

def get_single(asset_id):
    single_headers = {
        'Accept': 'application/json, text/plain, */*',
        'Authorization': token,
        'Origin': 'https://sport.optus.com.au',
        'Referer': 'https://sport.optus.com.au/',
        'User-Agent': USER_AGENT,
    }
    params = {
        'type': 'dash',
        'drm': 'widevine',
        'yspSdk': 'v3',
        'supportsCmaf': 'true',
        'adHol': 'false',
        'deviceId': 'c9cd09a3-daff-4c7c-a46a-b81e171c7dbe',
        'platform': 'web',
        'advertConsent': '0',
        'browserName': 'Chrome',
        'browserVersion': '125.0.0.0',
        'osName': 'Windows',
        'osVersion': '10',
        'playerName': 'BitmovinPlayer',
        'playerVersion': '8.131.0',
        'appVersion': '2.19.2',
        'ppid': decoded.get('custom:ppid', ''),
        'prohibitTargeting': 'false',
    }
    
    response = req.get(f"https://api-cdn.optussport.tv/api/playback/generalPlayback/web/users/{decoded.get('cognito:username', '')}/assets/{asset_id}", params=params, headers=single_headers)
    try:
        data = response.json()
        item = data['playback']['items']['item'][0]
        return item['url'], item['license']['@uri'], item['license']['drmData']
    except:
        return None, None, None

def do_cdm_internal(challenge_b64, lic_url, lic_token):
    lic_headers = {
        'accept': '*/*',
        'origin': 'https://sport.optus.com.au',
        'referer': 'https://sport.optus.com.au/',
        'user-agent': USER_AGENT,
        'x-axdrm-message': lic_token,
        'content-type': 'application/octet-stream',
    }
    response = req.post(lic_url, headers=lic_headers, data=base64.b64decode(challenge_b64))
    response_b64 = str(base64.b64encode(response.content), 'ascii')
    if response_b64.startswith('CA'):
        return response_b64
    return None

def do_cdm_external(pssh_b64, lic_url, lic_token):
    try:
        pssh_obj = PSSH(pssh_b64)
        device_obj = Device.load(WVD_PATH)
        cdm_obj = Cdm.from_device(device_obj)
        session_id = cdm_obj.open()
        
        challenge_data = cdm_obj.get_license_challenge(session_id, pssh_obj)
        
        lic_headers = {
            'accept': '*/*',
            'origin': 'https://sport.optus.com.au',
            'referer': 'https://sport.optus.com.au/',
            'user-agent': USER_AGENT,
            'x-axdrm-message': lic_token,
            'content-type': 'application/octet-stream',
        }
        
        licence = req.post(lic_url, headers=lic_headers, data=challenge_data)
        cdm_obj.parse_license(session_id, licence.content)
        
        keys = []
        for key in cdm_obj.get_keys(session_id):
            if key.type != 'SIGNING':
                keys.append(f"{key.kid.hex}:{key.key.hex()}")
        
        cdm_obj.close(session_id)
        return keys
    except Exception as e:
        print(f'CDM external failed: {e}', file=sys.stderr)
        return None

def do_action():
    get_token()
    
    if action == "login":
        login()
        sys.exit()
    
    if action == "channels":
        output = {'Channels': []}
        
        response = req.get('https://static.sport.optus.com.au/api/metadata/editorials/v2/home_linear_channels/web', headers=headers)
        
        try:
            data = response.json()
            channels = data.get('assets', [])
            
            # Also get live matches
            response2 = req.get('https://static.sport.optus.com.au/api/metadata/editorials/v2/home_live_matches/web', headers=headers)
            data2 = response2.json()
            current_time = datetime.datetime.now(datetime.timezone.utc)
            
            for a in data2.get('assets', []):
                try:
                    start_time = datetime.datetime.fromisoformat(a['broadcastStartTime'].replace("Z", "+00:00"))
                    end_time = datetime.datetime.fromisoformat(a['broadcastEndTime'].replace("Z", "+00:00"))
                    if start_time <= current_time <= end_time:
                        channels.append(a)
                except:
                    pass
            
            for ch in channels:
                channel = {
                    'Name': ch.get('title', 'Unknown'),
                    'Mode': 'live',
                    'SessionManifest': True,
                    'ManifestScript': f"id={ch.get('id', '')}",
                    'CdmType': 'widevine',
                    'UseCdm': True,
                    'Cdm': f"id={ch.get('id', '')}",
                    'Video': 'best',
                    'OnDemand': True,
                    'SpeedUp': True,
                }
                output['Channels'].append(channel)
            
            print(json.dumps(output, indent=2))
        except Exception as e:
            print(f"Error: {e}", file=sys.stderr)
            return "error"
    
    elif action == "events":
        output = {'Events': []}
        print(json.dumps(output, indent=2))
    
    elif action == "heartbeat":
        sys.exit()
    
    elif action == "manifest":
        try:
            asset_id = id
            video_url, lic_url, lic_token = get_single(asset_id)
            if not video_url:
                return "error"
            
            output = {
                "Cdn": [{"Name": "default", "ManifestUrl": video_url}],
                "ManifestUrl": video_url,
                "Headers": {"Manifest": {'User-Agent': USER_AGENT}, "Media": {'User-Agent': USER_AGENT}},
                "Heartbeat": {"Url": '', "Params": '', "PeriodMs": 5*60*1000},
                "LicenseUrl": lic_url,
                "LicenseToken": lic_token
            }
            print(json.dumps(output))
        except Exception as e:
            print(f"Error: {e}", file=sys.stderr)
            return "error"
    
    elif action == "cdm" and cdm == "internal":
        try:
            asset_id = id
            _, lic_url, lic_token = get_single(asset_id)
            if lic_url:
                result = do_cdm_internal(challenge, lic_url, lic_token)
                if result:
                    print(result)
                else:
                    return "error"
            else:
                return "error"
        except Exception as e:
            print(f"Error: {e}", file=sys.stderr)
            return "error"
    
    elif action == "cdm" and cdm == "external":
        try:
            asset_id = id
            video_url, lic_url, lic_token = get_single(asset_id)
            if lic_url:
                pssh_list = [pssh] if pssh else get_pssh_from_hls(video_url)
                if pssh_list:
                    keys = []
                    for p in pssh_list:
                        ks = do_cdm_external(p, lic_url, lic_token)
                        if ks:
                            keys.extend(ks)
                    keys = list(set(keys))
                    if keys:
                        for key in keys:
                            print(key)
                    else:
                        return "error"
                else:
                    return "error"
            else:
                return "error"
        except Exception as e:
            print(f"Error: {e}", file=sys.stderr)
            return "error"
    
    else:
        print("invalid action: " + action, file=sys.stderr)

if do_action() == "error":
    login()
    do_action()