"""CloudSSO client factory."""

from __future__ import annotations

import os


class AuthError(Exception):
    """Authentication/bootstrap failure for SDK client."""


def _load_sdk_components():
    """Load SDK classes lazily to keep imports test-friendly."""
    from alibabacloud_cloudsso20210515.client import Client as CloudssoClient
    from alibabacloud_credentials.client import Client as CredentialClient
    from alibabacloud_tea_openapi.models import Config as OpenApiConfig

    return CloudssoClient, OpenApiConfig, CredentialClient


def create_cloudsso_client(
    region: str,
    access_key_id: str = None,
    access_key_secret: str = None,
):
    """Create a CloudSSO SDK client with defined credential precedence."""
    if not isinstance(region, str) or not region.strip():
        raise AuthError("region must be a non-empty string")

    if (access_key_id and not access_key_secret) or (
        access_key_secret and not access_key_id
    ):
        raise AuthError(
            "CLI credentials require both access_key_id and access_key_secret"
        )

    try:
        CloudssoClient, OpenApiConfig, CredentialClient = _load_sdk_components()
        config_kwargs = {}

        if access_key_id and access_key_secret:
            config_kwargs["access_key_id"] = access_key_id
            config_kwargs["access_key_secret"] = access_key_secret
        else:
            env_access_key_id = os.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID")
            env_access_key_secret = os.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")
            if env_access_key_id and env_access_key_secret:
                config_kwargs["access_key_id"] = env_access_key_id
                config_kwargs["access_key_secret"] = env_access_key_secret
            else:
                config_kwargs["credential"] = CredentialClient()

        config = OpenApiConfig(**config_kwargs)
        config.endpoint = f"cloudsso.{region}.aliyuncs.com"
        return CloudssoClient(config)
    except AuthError:
        raise
    except Exception as exc:
        raise AuthError(f"failed to initialize CloudSSO client: {exc}") from exc