from typing import Optional
import hmac
import hashlib
import time
import base64
import os

VIDEO_PROXY_SECRET = os.environ.get("VIDEO_PROXY_SECRET", "").encode()

def sign_video_id(video_id: Optional[str|bool]) -> str:
    """Generate a signed token for a video ID."""
    if not VIDEO_PROXY_SECRET or not video_id:
        return ""  # Return empty if no secret configured
    
    timestamp = int(time.time() * 1000)  # milliseconds to match JS Date.now()
    payload = f"{video_id}:{timestamp}"
    signature = hmac.new(
        VIDEO_PROXY_SECRET,
        payload.encode(),
        hashlib.sha256
    ).hexdigest()
    
    token_data = f"{payload}:{signature}"
    # base64url encode (no padding, to match JS base64url)
    return base64.urlsafe_b64encode(token_data.encode()).decode().rstrip("=")