frosty/lib/apis/twitch_gql_api.dart

import 'dart:math';

import 'package:dio/dio.dart';
import 'package:flutter/foundation.dart';
import 'package:frosty/apis/base_api_client.dart';
import 'package:frosty/apis/twitch_integrity.dart';
import 'package:frosty/constants.dart';
import 'package:frosty/models/playback_access_token.dart';
import 'package:frosty/models/stream.dart';

/// Viewer sort for GQL directory / tag stream lists.
enum StreamViewerSort {
  viewersDesc,
  viewersAsc;

  String get gqlValue => switch (this) {
    StreamViewerSort.viewersDesc => 'VIEWER_COUNT',
    StreamViewerSort.viewersAsc => 'VIEWER_COUNT_ASC',
  };
}

/// Twitch GQL API client for playback tokens and directory queries
/// (freeform tags + sorted streams) that Helix does not expose.
///
/// Uses the Twitch web client ID (not the app's registered client ID)
/// since the GQL endpoint requires it.
class TwitchGqlApi extends BaseApiClient {
  TwitchGqlApi(Dio dio) : super(dio, 'https://gql.twitch.tv');

  static const _gqlHeaders = <String, String>{
    'Client-ID': twitchGqlClientId,
    'Content-Type': 'application/json',
  };

  Future<JsonMap> _gql(
    Map<String, Object?> body, {
    Map<String, String>? extraHeaders,
  }) async {
    final response = await post<JsonMap>(
      '/gql',
      data: body,
      headers: {..._gqlHeaders, ...?extraHeaders},
    );
    final errors = response['errors'];
    if (errors is List && errors.isNotEmpty) {
      final message = (errors.first as JsonMap)['message'] as String? ??
          'Twitch GQL error';
      if (message.toLowerCase().contains('integrity')) {
        throw IntegrityCheckException(message);
      }
      final data = response['data'];
      final dataEmpty = data == null ||
          (data is Map &&
              data.values.every((value) => value == null));
      if (dataEmpty) {
        throw ApiException(message);
      }
    }
    return response;
  }

  /// Optional web-session headers for directory pagination (page-2+).
  Map<String, String> _directoryHeaders({
    String? authToken,
    String? integrityToken,
    String? deviceId,
  }) {
    return {
      'User-Agent': playbackUserAgent,
      if (authToken != null && authToken.isNotEmpty)
        'Authorization': 'OAuth $authToken',
      if (deviceId != null && deviceId.isNotEmpty) 'X-Device-Id': deviceId,
      if (integrityToken != null && integrityToken.isNotEmpty)
        'Client-Integrity': integrityToken,
    };
  }

  /// Browser-consistent User-Agent for playback-related requests. Twitch has
  /// rejected access-token requests with non-browser UAs before
  /// (streamlink#6574); sending one consistent with the web client ID and
  /// web session token avoids the obvious fingerprint mismatch.
  static const playbackUserAgent =
      'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 '
      '(KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36';

  /// Headers for the HLS playlist/segment requests issued by the native
  /// player, mirroring what the web player sends to Usher/weaver.
  static const playbackHttpHeaders = <String, String>{
    'User-Agent': playbackUserAgent,
    'Referer': 'https://player.twitch.tv',
    'Origin': 'https://player.twitch.tv',
  };

  /// Fetches a playback access token for the given channel [login].
  ///
  /// When [authToken] is provided, the request is authenticated which may
  /// grant ad-free playback for subscribers and Turbo users.
  ///
  /// [playerType] / [platform] mirror the web player's GQL variables. Ad
  /// blocking (TwitchAdSolutions / vaft) uses non-`site` player types such as
  /// `popout` / `embed` / `autoplay`.
  ///
  /// Uses the web client's persisted GQL query (smaller payload, blends in
  /// with regular web traffic); falls back to the inline query template if
  /// Twitch ever rotates the persisted-query hash.
  Future<PlaybackAccessToken> getPlaybackAccessToken({
    required String login,
    String? authToken,
    String playerType = 'site',
    String platform = 'web',
  }) async {
    final headers = <String, String>{
      'Client-ID': twitchGqlClientId,
      'User-Agent': playbackUserAgent,
      if (authToken != null) 'Authorization': 'OAuth $authToken',
    };

    final variables = {
      'isLive': true,
      'login': login,
      'isVod': false,
      'vodID': '',
      'playerType': playerType,
      'platform': platform,
    };

    Future<JsonMap> query(Map<String, Object> body) =>
        post<JsonMap>('/gql', data: body, headers: headers);

    final response = await query({
      'operationName': 'PlaybackAccessToken',
      'extensions': {
        'persistedQuery': {
          'version': 1,
          // Stable for years; used by the web player and streamlink.
          'sha256Hash':
              'ed230aa1e33e07eebb8928504583da78a5173989fadfb1ac94be06a04f3cdbe9',
        },
      },
      'variables': variables,
    });

    // PersistedQueryNotFound (or similar) comes back as a 200 with an
    // errors array — retry once with the inline template before failing.
    if (response['errors'] != null && response['data'] == null) {
      debugPrint(
        'TwitchGqlApi: persisted query failed (${response['errors']}), '
        'falling back to inline template',
      );
      return PlaybackAccessToken.fromGqlResponse(
        await query({
          'operationName': 'PlaybackAccessToken_Template',
          'query':
              'query PlaybackAccessToken_Template(\$login: String!, \$isLive: Boolean!, \$vodID: ID!, \$isVod: Boolean!, \$playerType: String!) { streamPlaybackAccessToken(channelName: \$login, params: {platform: "web", playerBackend: "mediaplayer", playerType: \$playerType}) @include(if: \$isLive) { value signature __typename } videoPlaybackAccessToken(id: \$vodID, params: {platform: "web", playerBackend: "mediaplayer", playerType: \$playerType}) @include(if: \$isVod) { value signature __typename } }',
          'variables': variables,
        }),
      );
    }

    return PlaybackAccessToken.fromGqlResponse(response);
  }

  /// Fetches raw playlist text (multivariant or media) with playback headers.
  Future<String> fetchPlaylistText(String url) async {
    return get<String>(url, headers: playbackHttpHeaders);
  }

  /// Builds the HLS stream URL for the given channel [login] and [token].
  String buildHlsUrl({
    required String login,
    required PlaybackAccessToken token,
  }) {
    final random = Random().nextInt(999999);
    final encodedToken = Uri.encodeComponent(token.value);

    // Usher v2 — what the web player and streamlink use today. Same query
    // params and token; the multivariant playlist is standards-compliant
    // (EXT-X-SESSION-DATA + STREAM-INF only, no EXT-X-MEDIA/TWITCH-INFO).
    return 'https://usher.ttvnw.net/api/v2/channel/hls/$login.m3u8'
        '?sig=${token.signature}'
        '&token=$encodedToken'
        '&allow_source=true'
        '&allow_audio_only=true'
        '&fast_bread=true'
        '&supported_codecs=av1,h265,h264'
        '&reassignments_supported=true'
        '&platform=web'
        '&player_backend=mediaplayer'
        '&play_session_id=${_randomSessionId()}'
        '&playlist_include_framerate=true'
        '&p=$random';
  }

  /// 32-char hex play-session id, matching the web client and streamlink. Sent
  /// to Usher to identify the playback session; Usher tolerates its absence
  /// today but has historically tightened required params.
  String _randomSessionId() {
    final random = Random();
    final buffer = StringBuffer();
    for (var i = 0; i < 32; i++) {
      buffer.write(random.nextInt(16).toRadixString(16));
    }
    return buffer.toString();
  }

  /// Freeform tag name suggestions for search-as-you-type.
  Future<List<String>> searchFreeformTags({
    required String query,
    int first = 20,
  }) async {
    if (query.trim().isEmpty) return const [];

    final response = await _gql({
      'operationName': 'SearchFreeformTags',
      'query':
          r'query SearchFreeformTags($query: String!, $first: Int) {'
          r' searchFreeformTags(userQuery: $query, first: $first) {'
          r' edges { node { tagName } } } }',
      'variables': {'query': query, 'first': first},
    });

    final edges =
        (((response['data'] as JsonMap?)?['searchFreeformTags']
                as JsonMap?)?['edges']
            as List?) ??
        const [];

    return edges
        .map((edge) {
          final node = (edge as JsonMap)['node'] as JsonMap?;
          return node?['tagName'] as String?;
        })
        .whereType<String>()
        .toList();
  }

  /// Live streams matching optional [freeformTags] / [languages], sorted by viewers.
  ///
  /// Twitch caps `first` at 30 for this connection. Cursor pagination needs a
  /// Client-Integrity token (+ matching [deviceId] / web [authToken]); without
  /// them page-2 throws [IntegrityCheckException].
  Future<StreamsTwitch> getStreams({
    List<String>? freeformTags,
    List<String>? languages,
    StreamViewerSort sort = StreamViewerSort.viewersDesc,
    String? cursor,
    int first = 30,
    String? authToken,
    String? integrityToken,
    String? deviceId,
  }) async {
    final cappedFirst = first.clamp(1, 30);
    final gqlLangs = languages == null || languages.isEmpty
        ? null
        : languages
              .map((l) => l.trim().toUpperCase())
              .where((l) => l.isNotEmpty)
              .toList();

    final response = await _gql(
      {
        'operationName': 'FrostyTopStreams',
        'query':
            r'query FrostyTopStreams($first: Int, $after: Cursor, $tags: [String!], $sort: StreamSort, $langs: [Language!]) {'
            r' streams(first: $first, after: $after, options: { sort: $sort, freeformTags: $tags, languages: $langs }) {'
            r' edges { cursor node {'
            r' id title viewersCount createdAt language'
            r' game { id name }'
            r' broadcaster { id login displayName }'
            r' } } pageInfo { hasNextPage } } }',
        'variables': {
          'first': cappedFirst,
          'after': cursor,
          'tags': freeformTags,
          'sort': sort.gqlValue,
          'langs': gqlLangs,
        },
      },
      extraHeaders: _directoryHeaders(
        authToken: authToken,
        integrityToken: integrityToken,
        deviceId: deviceId,
      ),
    );

    final connection =
        (response['data'] as JsonMap?)?['streams'] as JsonMap? ?? const {};
    return _streamsFromConnection(connection);
  }

  /// Live streams under a category/game, with viewer sort and optional languages.
  Future<StreamsTwitch> getGameStreams({
    required String gameId,
    List<String>? languages,
    StreamViewerSort sort = StreamViewerSort.viewersDesc,
    String? cursor,
    int first = 30,
    String? authToken,
    String? integrityToken,
    String? deviceId,
  }) async {
    final cappedFirst = first.clamp(1, 30);
    final gqlLangs = languages == null || languages.isEmpty
        ? null
        : languages
              .map((l) => l.trim().toUpperCase())
              .where((l) => l.isNotEmpty)
              .toList();

    final response = await _gql(
      {
        'operationName': 'FrostyGameStreams',
        'query':
            r'query FrostyGameStreams($id: ID!, $first: Int, $after: Cursor, $sort: StreamSort, $langs: [Language!]) {'
            r' game(id: $id) { streams(first: $first, after: $after, options: { sort: $sort, languages: $langs }) {'
            r' edges { cursor node {'
            r' id title viewersCount createdAt language'
            r' game { id name }'
            r' broadcaster { id login displayName }'
            r' } } pageInfo { hasNextPage } } } }',
        'variables': {
          'id': gameId,
          'first': cappedFirst,
          'after': cursor,
          'sort': sort.gqlValue,
          'langs': gqlLangs,
        },
      },
      extraHeaders: _directoryHeaders(
        authToken: authToken,
        integrityToken: integrityToken,
        deviceId: deviceId,
      ),
    );

    final game = (response['data'] as JsonMap?)?['game'] as JsonMap?;
    if (game == null) {
      return const StreamsTwitch([], {});
    }
    return _streamsFromConnection(game['streams'] as JsonMap? ?? const {});
  }

  /// Persisted hashes used by the Twitch web Follow button (same as Xtra).
  static const _followUserHash =
      '800e7346bdf7e5278a3c1d3f21b2b56e2639928f86815677a7126b093b2fdd08';
  static const _unfollowUserHash =
      'f7dae976ebf41c755ae2d758546bfd176b4eeb856656098bb40e0a672ca0d880';

  /// Follows [targetId] using the web GQL session. Helix no longer supports this.
  ///
  /// Requires [authToken] from the Twitch web cookie (`gqlToken`). Some accounts
  /// need a [integrityToken] + matching [deviceId]; callers should retry after
  /// [fetchIntegrityToken] when [IntegrityCheckException] is thrown.
  Future<void> followUser({
    required String targetId,
    required String authToken,
    bool disableNotifications = false,
    String? integrityToken,
    String? deviceId,
  }) async {
    await _mutateFollow(
      operationName: 'FollowButton_FollowUser',
      sha256Hash: _followUserHash,
      authToken: authToken,
      integrityToken: integrityToken,
      deviceId: deviceId,
      variables: {
        'input': {
          'disableNotifications': disableNotifications,
          'targetID': targetId,
        },
      },
      successPath: const ['followUser'],
    );
  }

  /// Unfollows [targetId] using the web GQL session.
  Future<void> unfollowUser({
    required String targetId,
    required String authToken,
    String? integrityToken,
    String? deviceId,
  }) async {
    await _mutateFollow(
      operationName: 'FollowButton_UnfollowUser',
      sha256Hash: _unfollowUserHash,
      authToken: authToken,
      integrityToken: integrityToken,
      deviceId: deviceId,
      variables: {
        'input': {'targetID': targetId},
      },
      successPath: const ['unfollowUser'],
    );
  }

  /// Mints a Client-Integrity token for authenticated GQL mutations.
  ///
  /// Bound to [deviceId] and [authToken]; send the same values on follow calls.
  /// Tokens minted outside a real browser are usually flagged `is_bad_bot` —
  /// those throw [IntegrityCheckException] so callers can fall back to a
  /// WebView capture.
  Future<({String token, int expirationMs})> fetchIntegrityToken({
    required String authToken,
    required String deviceId,
  }) async {
    final response = await post<JsonMap>(
      '/integrity',
      data: <String, dynamic>{},
      headers: {
        'Client-ID': twitchGqlClientId,
        'Authorization': 'OAuth $authToken',
        'X-Device-Id': deviceId,
        'User-Agent': playbackUserAgent,
        'Content-Type': 'application/json',
      },
    );

    final token = response['token'] as String?;
    final expiration = response['expiration'];
    if (token == null || token.isEmpty) {
      throw const ApiException('Twitch integrity token missing from response');
    }
    if (TwitchIntegrity.isBadBot(token)) {
      throw const IntegrityCheckException(
        'Twitch integrity token flagged as bad bot',
      );
    }
    final expirationMs = expiration is int
        ? expiration
        : int.tryParse('$expiration') ??
              TwitchIntegrity.expirationMs(token) ??
              0;
    return (token: token, expirationMs: expirationMs);
  }

  Future<void> _mutateFollow({
    required String operationName,
    required String sha256Hash,
    required String authToken,
    required JsonMap variables,
    required List<String> successPath,
    String? integrityToken,
    String? deviceId,
  }) async {
    final headers = <String, String>{
      'Client-ID': twitchGqlClientId,
      'Content-Type': 'application/json',
      'Authorization': 'OAuth $authToken',
      'User-Agent': playbackUserAgent,
      if (deviceId != null && deviceId.isNotEmpty) 'X-Device-Id': deviceId,
      if (integrityToken != null && integrityToken.isNotEmpty)
        'Client-Integrity': integrityToken,
    };

    final response = await post<dynamic>(
      '/gql',
      data: {
        'operationName': operationName,
        'variables': variables,
        'extensions': {
          'persistedQuery': {
            'version': 1,
            'sha256Hash': sha256Hash,
          },
        },
      },
      headers: headers,
    );

    final map = _gqlPayloadMap(response);
    _throwIfGqlFailed(map);

    JsonMap? cursor = map['data'] as JsonMap?;
    for (final key in successPath) {
      final next = cursor?[key];
      if (next is JsonMap) {
        cursor = next;
      } else if (next == null) {
        throw ApiException('Twitch $operationName returned no data');
      } else {
        return;
      }
    }
  }

  JsonMap _gqlPayloadMap(dynamic response) {
    if (response is List) {
      if (response.isEmpty || response.first is! Map) {
        throw const ApiException('Unexpected Twitch GQL response');
      }
      return Map<String, dynamic>.from(response.first as Map);
    }
    if (response is Map) {
      return Map<String, dynamic>.from(response);
    }
    throw const ApiException('Unexpected Twitch GQL response');
  }

  void _throwIfGqlFailed(JsonMap map) {
    final errors = map['errors'];
    if (errors is! List || errors.isEmpty) return;

    final message =
        (errors.first as JsonMap)['message'] as String? ?? 'Twitch GQL error';
    final lower = message.toLowerCase();
    if (lower.contains('integrity')) {
      throw IntegrityCheckException(message);
    }
    throw ApiException(message);
  }

  StreamsTwitch _streamsFromConnection(JsonMap connection) {
    final edges = (connection['edges'] as List?) ?? const [];
    final pageInfo = connection['pageInfo'] as JsonMap?;
    // Prefer explicit pageInfo; if missing, assume more when we got a full page.
    final hasNext = pageInfo?['hasNextPage'] as bool? ?? edges.length >= 30;

    final streams = <StreamTwitch>[];
    String? nextCursor;

    for (final edge in edges) {
      final edgeMap = edge as JsonMap;
      nextCursor = edgeMap['cursor'] as String?;
      final node = edgeMap['node'] as JsonMap?;
      if (node == null) continue;
      streams.add(_streamFromNode(node));
    }

    return StreamsTwitch(
      streams,
      hasNext && nextCursor != null && nextCursor.isNotEmpty
          ? {'cursor': nextCursor}
          : const {},
    );
  }

  StreamTwitch _streamFromNode(JsonMap node) {
    final broadcaster = node['broadcaster'] as JsonMap? ?? const {};
    final game = node['game'] as JsonMap? ?? const {};
    final login = broadcaster['login'] as String? ?? '';
    final language = (node['language'] as String? ?? '').toLowerCase();

    return StreamTwitch(
      broadcaster['id'] as String? ?? '',
      login,
      broadcaster['displayName'] as String? ?? login,
      game['id'] as String? ?? '',
      game['name'] as String? ?? '',
      node['title'] as String? ?? '',
      (node['viewersCount'] as num?)?.toInt() ?? 0,
      node['createdAt'] as String? ?? '',
      // Helix-style placeholder so existing thumbnail widgets keep working.
      'https://static-cdn.jtvnw.net/previews-ttv/live_user_$login-{width}x{height}.jpg',
      language,
      const [],
    );
  }
}