"""Baota panel signed file download URLs (official API token, not UI share links)."""

from __future__ import annotations

import hashlib
import time
from urllib.parse import quote

from server.infrastructure.btpanel.credentials import BtPanelCredentials


def signed_download_url(creds: BtPanelCredentials, remote_path: str) -> str:
    """Build ``/download?filename=…&request_time&request_token`` for remote curl/wget.

    Equivalent to automating panel file download with API signature — not the UI
  ``/down/{token}`` share link (that endpoint has no documented API).
    """
    path = (remote_path or "").strip()
    if not path.startswith("/"):
        raise ValueError("remote_path must be absolute")
    now = int(time.time())
    request_token = hashlib.md5(f"{now}{creds.api_key}".encode()).hexdigest()  # nosec B324
    filename = quote(path, safe="")
    base = creds.base_url.rstrip("/")
    return (
        f"{base}/download?filename={filename}"
        f"&request_time={now}&request_token={request_token}"
    )