"""SSO 打开链(与 crypto_okx lib.hub.hub_bridge_auth 算法一致)."""
from __future__ import annotations

import hashlib
import hmac
import time
from urllib.parse import urlencode


def make_sso_token(bridge_token: str, *, ttl_sec: int = 120) -> str:
    exp = int(time.time()) + max(30, int(ttl_sec))
    payload = str(exp)
    sig = hmac.new(
        bridge_token.encode("utf-8"),
        payload.encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()
    return f"{payload}.{sig}"


def build_embed_open_url(
    base_url: str,
    *,
    bridge_token: str,
    embed_path: str = "/embed",
    ttl_sec: int = 120,
) -> str:
    root = (base_url or "").rstrip("/")
    path = embed_path or "/embed"
    if not path.startswith("/"):
        path = "/" + path
    token = make_sso_token(bridge_token, ttl_sec=ttl_sec)
    q = urlencode({"token": token, "next": path})
    return f"{root}/hub_sso?{q}"