import base64
import hashlib
import time
from urllib.parse import quote, urlencode

from django.conf import settings
from django.http import HttpResponseRedirect


def signed_media_redirect(relative_path, *, download=False, lifetime=300):
    """Create an Nginx secure_link URL after Django has authorized the request."""
    safe_path = quote(str(relative_path).replace("\\", "/").lstrip("/"), safe="/")
    uri = f"/protected-media/{safe_path}"
    expires = int(time.time()) + lifetime
    source = f"{expires}{uri} {settings.MEDIA_SIGNING_SECRET}".encode()
    digest = hashlib.md5(source, usedforsecurity=False).digest()
    signature = base64.urlsafe_b64encode(digest).rstrip(b"=").decode()
    query = {"md5": signature, "expires": expires}
    if download:
        query["download"] = "1"
    return HttpResponseRedirect(f"{uri}?{urlencode(query)}")