import json, urllib.request, urllib.parse, datetime
from pathlib import Path

TOKEN_PATH = Path.home() / '.hermes' / 'google_token.json'

t = json.loads(TOKEN_PATH.read_text())
form = urllib.parse.urlencode({
    'client_id': t['client_id'],
    'client_secret': t['client_secret'],
    'refresh_token': t['refresh_token'],
    'grant_type': 'refresh_token',
}).encode()

req = urllib.request.Request(
    'https://oauth2.googleapis.com/token',
    data=form,
    headers={'Content-Type': 'application/x-www-form-urlencoded'},
    method='POST'
)

try:
    with urllib.request.urlopen(req, timeout=15) as r:
        body = json.loads(r.read().decode())
except urllib.error.HTTPError as e:
    print('REFRESH HTTP', e.code, e.read().decode()[:300])
    raise SystemExit(1)

if 'access_token' not in body:
    print('REFRESH FAILED:', json.dumps(body)[:300])
    raise SystemExit(2)

new = dict(t)
new['access_token'] = body['access_token']
new['token'] = body['access_token']
new['type'] = 'Bearer'
new['expiry'] = datetime.datetime.now(datetime.timezone.utc).timestamp() + body.get('expires_in', 3600)
new['expiry_date'] = int(datetime.datetime.now(datetime.timezone.utc).timestamp() * 1000) + body.get('expires_in', 3600) * 1000
if 'scope' in body:
    new['scopes'] = body['scope'].split(' ')

TOKEN_PATH.write_text(json.dumps(new, indent=2))
TOKEN_PATH.chmod(0o600)

# Verify write
saved = json.loads(TOKEN_PATH.read_text())
print('REFRESH OK')
print('access_token_prefix:', saved['access_token'][:8] + '...')
print('expires_in:', body.get('expires_in'))
print('scope_present:', 'calendar' in ' '.join(saved.get('scopes', [])), 'gmail.readonly:', 'gmail.readonly' in ' '.join(saved.get('scopes', [])))
print('new_expiry_delta_s:', int(saved['expiry'] - datetime.datetime.now(datetime.timezone.utc).timestamp()))