#!/usr/bin/python3
import sys
import os
import base64
import json
import datetime
import pytz

# Add parent directory to path for o11 import
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
import o11

from bs4 import BeautifulSoup
from pywidevine.cdm import Cdm
from pywidevine.device import Device
from pywidevine.pssh import PSSH

# Parse command line parameters
user = o11.parse_params(sys.argv, 'user')
password = o11.parse_params(sys.argv, 'password')
device = o11.parse_params(sys.argv, 'device')
pin = o11.parse_params(sys.argv, 'pin')

id = o11.parse_params(sys.argv, 'id')
action = o11.parse_params(sys.argv, 'action')

bind = o11.parse_params(sys.argv, 'bind')
proxy = o11.parse_params(sys.argv, 'proxy')
doh = o11.parse_params(sys.argv, 'doh')
worker = o11.parse_params(sys.argv, 'worker')

cdm = o11.parse_params(sys.argv, 'cdm')
drm = o11.parse_params(sys.argv, 'drm')
kid = o11.parse_params(sys.argv, 'kid')
pssh = o11.parse_params(sys.argv, 'pssh')
challenge = o11.parse_params(sys.argv, 'challenge')

heartbeaturl = o11.parse_params(sys.argv, 'heartbeaturl')
heartbeatparams = o11.parse_params(sys.argv, 'heartbeatparams')

# Session setup
o11Session = o11.session(bind=bind, proxy=proxy, worker=worker)
req = o11Session.get_session()
if doh != "":
    o11.dns(doh)

if challenge == "cert":
    challenge = "CAQ="

# Configuration
WVD_PATH = './WVD.wvd'
authFile = '/Spectrum_auth.json'
SCRIPT_DIR = os.path.abspath(os.path.dirname(__file__))

USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36'

headers = {
    'accept': 'application/json, text/plain, */*',
    'origin': 'https://watch.spectrum.net',
    'referer': 'https://watch.spectrum.net/',
    'user-agent': USER_AGENT,
}

token = ''

def get_auth():
    try:
        return json.load(open(SCRIPT_DIR + authFile))
    except:
        return None

def save_auth(auth_data):
    json.dump(auth_data, open(SCRIPT_DIR + authFile, 'w'), indent=2)

def generate_pkce_pair():
    import hashlib
    import secrets
    code_verifier = secrets.token_urlsafe(32)
    code_challenge = base64.urlsafe_b64encode(hashlib.sha256(code_verifier.encode()).digest()).decode().rstrip('=')
    return code_verifier, code_challenge

def do_auth(device_verifier, device_id, code_challenge):
    auth_headers = {
        'accept': 'application/json, text/plain, */*',
        'authorization': 'Bearer ' + device_verifier,
        'content-type': 'application/x-www-form-urlencoded',
        'origin': 'https://watch.spectrum.net',
        'referer': 'https://watch.spectrum.net/',
        'user-agent': USER_AGENT,
        'x-client-version': '17.9.0.144058264',
    }
    data = {
        'client_id': 'stva-ovp',
        'response_type': 'code',
        'state': 'state',
        'client_device_id': device_id,
        'nonce': 'nlHMvNOeJHoPy4F6hpm4cMZl23hQobsY',
        'supportSMB': 'true',
        'supportMDUBulk': 'true',
        'code_challenge': code_challenge,
        'code_challenge_method': 'S256',
    }
    response = req.post('https://apis.spectrum.net/auth/oauth/v2/consumer/video/deviceverifier/auth', headers=auth_headers, data=data)
    return response.json()['code']

def exchange_code_for_token(device_id, code, code_verifier):
    token_headers = {
        'accept': 'application/json, text/plain, */*',
        'content-type': 'application/x-www-form-urlencoded',
        'origin': 'https://watch.spectrum.net',
        'referer': 'https://watch.spectrum.net/',
        'user-agent': USER_AGENT,
        'x-client-version': '17.9.0.144058264',
    }
    data = {
        'client_id': 'stva-ovp',
        'grant_type': 'authorization_code',
        'code': code,
        'client_device_id': device_id,
        'code_verifier': code_verifier,
    }
    response = req.post('https://apis.spectrum.net/auth/oauth/v2/token', headers=token_headers, data=data)
    data = response.json()
    return data['access_token'], data['deviceVerifier']

def login():
    global token
    print("logging in...", file=sys.stderr)
    
    auth = get_auth()
    if not auth or 'device_verifier' not in auth:
        print("No auth found. Please add Spectrum auth to auth file.", file=sys.stderr)
        print("Login to https://watch.spectrum.net and copy 'xoauth_device_verifier' and 'device_id' from Local Storage", file=sys.stderr)
        save_auth({'device_verifier': 'ENTER xoauth_device_verifier HERE', 'device_id': 'ENTER device_id HERE'})
        sys.exit(1)
    
    try:
        device_verifier = auth['device_verifier'].replace('"', '')
        device_id = auth['device_id'].replace('"', '')
        
        code_verifier, code_challenge = generate_pkce_pair()
        code = do_auth(device_verifier, device_id, code_challenge)
        tok, new_device_verifier = exchange_code_for_token(device_id, code, code_verifier)
        
        save_auth({'device_verifier': new_device_verifier, 'device_id': device_id})
        token = tok
        print("logged in successfully", file=sys.stderr)
        return tok
    except Exception as e:
        print(f"Login failed: {e}", file=sys.stderr)
        sys.exit(1)

def get_token():
    global token
    if token:
        return token
    return login()

def find_wv_pssh_offsets(raw):
    offsets = []
    offset = 0
    while True:
        offset = raw.find(b'pssh', offset)
        if offset == -1:
            break
        size = int.from_bytes(raw[offset-4:offset], byteorder='big')
        pssh_offset = offset - 4
        offsets.append(raw[pssh_offset:pssh_offset+size])
        offset += size
    return offsets

def to_pssh(content):
    wv_offsets = find_wv_pssh_offsets(content)
    return [base64.b64encode(wv_offset).decode() for wv_offset in wv_offsets]

def get_pssh_from_mpd(url):
    response = req.get(url, headers=headers)
    content_protections = BeautifulSoup(response.content, features="xml").findAll('ContentProtection')
    
    for cp in content_protections:
        if cp.get('schemeIdUri', '').lower() == 'urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed':
            cenc_pssh = cp.find('cenc:pssh')
            if cenc_pssh:
                return cenc_pssh.text
    
    # Try init segment
    try:
        soup = BeautifulSoup(response.content, features="xml")
        init = soup.find('SegmentTemplate')['initialization']
        bandwidth = soup.find('Representation')['bandwidth']
        rep_id = soup.find('Representation')['id']
        base_url = soup.find('BaseURL').text
        
        loc_parts = str(response.url).split('/')
        loc_parts.pop()
        
        if 'http' in base_url:
            init_url = base_url + init.replace('$Bandwidth$', bandwidth).replace('$RepresentationID$', rep_id)
        else:
            init_url = '/'.join(loc_parts) + '/' + base_url + init.replace('$Bandwidth$', bandwidth).replace('$RepresentationID$', rep_id)
        
        init_response = req.get(init_url, headers=headers)
        return to_pssh(init_response.content)[0]
    except:
        return None

def get_single(channel_id):
    single_headers = {
        'authorization': 'Bearer ' + token,
        'content-type': 'application/json',
        'origin': 'https://watch.spectrum.net',
        'referer': 'https://watch.spectrum.net/',
        'user-agent': USER_AGENT,
    }
    params = {
        'csid': 'stva_ovp_dash_pc_live',
        'dai-supported': 'true',
        'drm-supported': 'true',
        'vast-supported': 'true',
        'secureTransport': 'true',
        'use_token': 'true',
    }
    data = json.dumps({
        'deviceCapabilities': {
            'packaging': 'dash',
            'drm': 'cenc',
            'videoCodecs': ['avc'],
            'audioCodecs': ['aac', 'ac3', 'eac3'],
        },
    }).replace(' ', '')
    
    response = req.post(f'https://apis-vid.spectrum.net/ipvs/api/smarttv/stream/live/v4/{channel_id}', params=params, headers=single_headers, data=data)
    
    try:
        data = response.json()
        return data['streamUrl'], data['drmContentId'], data['jwtToken']
    except:
        return None, None, None

def do_cdm_internal(challenge_b64, content_id, stream_token):
    lic_headers = {
        'accept': '*/*',
        'authorization': 'Bearer ' + stream_token,
        'origin': 'https://watch.spectrum.net',
        'referer': 'https://watch.spectrum.net/',
        'user-agent': USER_AGENT,
        'content-type': 'application/octet-stream',
    }
    params = {'CrmId': 'twc', 'AccountId': 'twc', 'ContentId': content_id}
    response = req.post('https://pi-lite.spectrum.net/licenseServer/widevine/v1/twc/license', headers=lic_headers, params=params, data=base64.b64decode(challenge_b64))
    response_b64 = str(base64.b64encode(response.content), 'ascii')
    if response_b64.startswith('CA'):
        return response_b64
    return None

def do_cdm_external(pssh_b64, content_id, stream_token):
    try:
        pssh_obj = PSSH(pssh_b64)
        device_obj = Device.load(WVD_PATH)
        cdm_obj = Cdm.from_device(device_obj)
        session_id = cdm_obj.open()
        
        challenge_data = cdm_obj.get_license_challenge(session_id, pssh_obj)
        
        lic_headers = {
            'accept': '*/*',
            'authorization': 'Bearer ' + stream_token,
            'origin': 'https://watch.spectrum.net',
            'referer': 'https://watch.spectrum.net/',
            'user-agent': USER_AGENT,
            'content-type': 'application/octet-stream',
        }
        params = {'CrmId': 'twc', 'AccountId': 'twc', 'ContentId': content_id}
        
        licence = req.post('https://pi-lite.spectrum.net/licenseServer/widevine/v1/twc/license', headers=lic_headers, params=params, data=challenge_data)
        cdm_obj.parse_license(session_id, licence.content)
        
        keys = []
        for key in cdm_obj.get_keys(session_id):
            if key.type != 'SIGNING':
                keys.append(f"{key.kid.hex}:{key.key.hex()}")
        
        cdm_obj.close(session_id)
        return keys
    except Exception as e:
        print(f'CDM external failed: {e}', file=sys.stderr)
        return None

def do_action():
    get_token()
    
    if action == "login":
        login()
        sys.exit()
    
    if action == "channels":
        output = {'Channels': []}
        
        ch_headers = {
            'authorization': 'Bearer ' + token,
            'content-type': 'application/json;charset=utf-8',
            'origin': 'https://watch.spectrum.net',
            'referer': 'https://watch.spectrum.net/',
            'user-agent': USER_AGENT,
        }
        
        response = req.get('https://apis-vid.spectrum.net/lantern/api/smarttv/channels/v3', params={'streamVersion': '4'}, headers=ch_headers)
        
        try:
            data = response.json()
            for ch in data:
                if ch.get('availableInMarket'):
                    channel = {
                        'Name': ch.get('networkName', 'Unknown'),
                        'Mode': 'live',
                        'SessionManifest': True,
                        'ManifestScript': f"id={ch.get('entitlementId', '')}",
                        'CdmType': 'widevine',
                        'UseCdm': True,
                        'Cdm': f"id={ch.get('entitlementId', '')}",
                        'Video': 'best',
                        'OnDemand': True,
                        'SpeedUp': True,
                    }
                    output['Channels'].append(channel)
            
            print(json.dumps(output, indent=2))
        except Exception as e:
            print(f"Error: {e}", file=sys.stderr)
            return "error"
    
    elif action == "events":
        output = {'Events': []}
        print(json.dumps(output, indent=2))
    
    elif action == "heartbeat":
        sys.exit()
    
    elif action == "manifest":
        try:
            channel_id = id
            video_url, content_id, stream_token = get_single(channel_id)
            if not video_url:
                return "error"
            
            output = {
                "Cdn": [{"Name": "default", "ManifestUrl": video_url}],
                "ManifestUrl": video_url,
                "Headers": {"Manifest": {'User-Agent': USER_AGENT}, "Media": {'User-Agent': USER_AGENT}},
                "Heartbeat": {"Url": '', "Params": '', "PeriodMs": 5*60*1000},
                "ContentId": content_id,
                "StreamToken": stream_token
            }
            print(json.dumps(output))
        except Exception as e:
            print(f"Error: {e}", file=sys.stderr)
            return "error"
    
    elif action == "cdm" and cdm == "internal":
        try:
            channel_id = id
            _, content_id, stream_token = get_single(channel_id)
            if content_id and stream_token:
                result = do_cdm_internal(challenge, content_id, stream_token)
                if result:
                    print(result)
                else:
                    return "error"
            else:
                return "error"
        except Exception as e:
            print(f"Error: {e}", file=sys.stderr)
            return "error"
    
    elif action == "cdm" and cdm == "external":
        try:
            channel_id = id
            video_url, content_id, stream_token = get_single(channel_id)
            if content_id and stream_token:
                pssh_to_use = pssh if pssh else get_pssh_from_mpd(video_url)
                if pssh_to_use:
                    keys = do_cdm_external(pssh_to_use, content_id, stream_token)
                    if keys:
                        for key in keys:
                            print(key)
                    else:
                        return "error"
                else:
                    return "error"
            else:
                return "error"
        except Exception as e:
            print(f"Error: {e}", file=sys.stderr)
            return "error"
    
    else:
        print("invalid action: " + action, file=sys.stderr)

if do_action() == "error":
    login()
    do_action()