import os
import hashlib
import hmac
from datetime import datetime, timedelta

class SecureODAMClient:
    def __init__(self):
        # Load API key from environment, never hardcode
        self.api_key = os.getenv('ODAM_API_KEY')
        if not self.api_key:
            raise ValueError("ODAM_API_KEY environment variable required")
        
        self.base_url = "https://api.odam.dev/v1"  # Always use HTTPS
        
    def secure_request(self, endpoint, data):
        # Validate and sanitize input data
        clean_data = self.sanitize_input(data)
        
        # Add timestamp for request freshness
        clean_data['timestamp'] = datetime.utcnow().isoformat()
        
        # Create request signature
        signature = self.create_signature(clean_data)
        
        headers = {
            'Authorization': f'Bearer {self.api_key}',
            'X-Signature': signature,
            'Content-Type': 'application/json'
        }
        
        # Make secure request
        response = requests.post(
            f"{self.base_url}/{endpoint}",
            json=clean_data,
            headers=headers,
            timeout=30  # Prevent hanging requests
        )
        
        return response.json()
    
    def sanitize_input(self, data):
        """Remove sensitive information and validate input"""
        # Remove potentially sensitive fields
        sensitive_fields = ['password', 'ssn', 'credit_card']
        
        clean_data = {}
        for key, value in data.items():
            if key.lower() not in sensitive_fields:
                # Basic input validation
                if isinstance(value, str) and len(value) < 10000:
                    clean_data[key] = value
                elif isinstance(value, (int, float, bool)):
                    clean_data[key] = value
        
        return clean_data
    
    def create_signature(self, data):
        """Create HMAC signature for request verification"""
        message = json.dumps(data, sort_keys=True)
        signature = hmac.new(
            self.api_key.encode(),
            message.encode(),
            hashlib.sha256
        ).hexdigest()
        return signature