#! /usr/bin/env python3

import requests
import logging

from pathlib import Path
import datetime
import jwt # PyJWT

GRANT_TYPE = "client_credentials"
CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
CLIENT_ID = "<CLIENT_ID>"
TOKEN_ENDPOINT_URL = "https://<COMPID>.<http://suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token|suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token>"
CONNECT_ENDPOINT_URL = "https://<COMPID>.<http://connect.api.netsuite.com/services/rest/auth/oauth2/v1/token|connect.api.netsuite.com/services/rest/auth/oauth2/v1/token>"

CERTIFICATE_ID = "<CERTIFICATE_ID_GENERATED_WHEN_UPLOADED_TO_NS>"
CERTIFICATE_KEY_FILE = Path("certificates/key.pem")

SCOPES = ['SuiteAnalytics']


def main():
    now = datetime.datetime.now()
    payload = {
        'iss': CLIENT_ID,
        'scope': SCOPES,
        'aud': CONNECT_ENDPOINT_URL,
        'iat': now.timestamp(),
        'exp': now + datetime.timedelta(hours=1),
    }

    private_key = CERTIFICATE_KEY_FILE.read_bytes()

    jwt_assertion = jwt.encode(payload, private_key, algorithm="PS256", headers={'kid': CERTIFICATE_ID})

    data = {
            'grant_type': GRANT_TYPE,
            'client_assertion_type': CLIENT_ASSERTION_TYPE,
            'client_assertion': jwt_assertion,
    }
    resp = <http://requests.post|requests.post>(TOKEN_ENDPOINT_URL, data=data)
    data = resp.json()
    logging.debug("Received '%s'[%d]: %s", TOKEN_ENDPOINT_URL, resp.status_code, resp.raw)
    assert data["access_token"]



if __name__ == '__main__':
    main()