SPOTIFY_CLIENT_ID=... SPOTIFY_CLIENT_SECRET=... ./get-spotify-refresh-token.sh

#!/usr/bin/env bash
# get-spotify-refresh-token.sh
# One-time helper to obtain a Spotify REFRESH TOKEN for the Web API.
#
# Usage (env vars OR flags):
#   SPOTIFY_CLIENT_ID=... SPOTIFY_CLIENT_SECRET=... ./get-spotify-refresh-token.sh
#   ./get-spotify-refresh-token.sh --client-id=... --client-secret=...
#
# Options:
#   --client-id=ID
#   --client-secret=SECRET
#   --redirect-uri=URI        (default: http://127.0.0.1:8888/callback)
#   --scopes="space separated scopes"
#   --pkce                    (use Authorization Code with PKCE; no client secret needed)
#
# Output on success:
#   export SPOTIFY_CLIENT_ID="..."
#   export SPOTIFY_CLIENT_SECRET="..."     # omitted in --pkce mode
#   export SPOTIFY_REFRESH_TOKEN="..."
#
# Requirements: bash, curl, jq, python3. (openssl recommended)

set -euo pipefail

# -------- defaults --------
CLIENT_ID="${SPOTIFY_CLIENT_ID:-}"
CLIENT_SECRET="${SPOTIFY_CLIENT_SECRET:-}"
REDIRECT_URI_DEFAULT="http://127.0.0.1:8888/callback"
REDIRECT_URI="${SPOTIFY_REDIRECT_URI:-$REDIRECT_URI_DEFAULT}"
SCOPES="${SPOTIFY_SCOPES:-user-modify-playback-state user-read-playback-state}"
USE_PKCE="false"

# -------- args --------
for arg in "$@"; do
  case "$arg" in
    --client-id=*)       CLIENT_ID="${arg#*=}";;
    --client-secret=*)   CLIENT_SECRET="${arg#*=}";;
    --redirect-uri=*)    REDIRECT_URI="${arg#*=}";;
    --scopes=*)          SCOPES="${arg#*=}";;
    --pkce)              USE_PKCE="true";;
    --help|-h)
      sed -n '1,60p' "$0"; exit 0;;
    *)
      echo "Unknown option: $arg" >&2; exit 2;;
  esac
done

need() { if [[ -z "${!1:-}" ]]; then echo "Missing required value: $1" >&2; exit 2; fi; }

dep_check() {
  for cmd in curl jq python3; do
    command -v "$cmd" >/dev/null 2>&1 || { echo "Missing dependency: $cmd" >&2; exit 2; }
  done
}
dep_check

# URL-encode via Python
urlencode() {
  python3 - "$1" <<'PY' 2>/dev/null
import sys, urllib.parse
print(urllib.parse.quote(sys.argv[1], safe=''))
PY
}

# Parse host/port from redirect for the tiny local server
parse_host_port() {
  python3 - "$1" <<'PY' 2>/dev/null
import sys, urllib.parse
u = urllib.parse.urlparse(sys.argv[1])
host = u.hostname or "127.0.0.1"
port = u.port or 8888
print(f"{host} {port}")
PY
}

# PKCE helpers
b64url() {
  python3 - <<'PY' 2>/dev/null
import sys, base64
print(base64.urlsafe_b64encode(sys.stdin.read().encode()).decode().rstrip("="))
PY
}
sha256_hex() {
  python3 - <<'PY' 2>/dev/null
import sys, hashlib
print(hashlib.sha256(sys.stdin.read().encode()).digest().hex())
PY
}

# -------- prepare auth request --------
need CLIENT_ID
if [[ "$USE_PKCE" != "true" ]]; then
  need CLIENT_SECRET
fi

if command -v openssl >/dev/null 2>&1; then
  STATE="$(openssl rand -hex 16)"
else
  STATE="state$(date +%s)"
fi

if [[ "$USE_PKCE" == "true" ]]; then
  # RFC 7636: code_verifier 43-128 chars
  if command -v openssl >/dev/null 2>&1; then
    CODE_VERIFIER="$(openssl rand -hex 32)"
  else
    CODE_VERIFIER="cv$(date +%s)$(od -An -N8 -tx1 /dev/urandom 2>/dev/null | tr -d ' \n')"
  fi
  # code_challenge = BASE64URL-ENCODE(SHA256(code_verifier))
  CODE_CHALLENGE="$(printf '%s' "$CODE_VERIFIER" | python3 - <<'PY'
import sys, hashlib, base64
cv = sys.stdin.read().encode()
print(base64.urlsafe_b64encode(hashlib.sha256(cv).digest()).decode().rstrip("="))
PY
)"
fi

ENC_REDIRECT="$(urlencode "$REDIRECT_URI")"
ENC_SCOPES="$(printf %s "$SCOPES" | sed 's/ /%20/g')"

AUTH_URL="https://accounts