#!/usr/bin/env python
"""Mint a Globus HTTPS bearer token for the JWST root collection so you can
download release files with wget/curl.

  pip install globus-sdk      # once
  python get_globus_token.py  # opens an ORCID/Globus login in your browser

Then:
  TOKEN=<paste the printed token>
  wget --header="Authorization: Bearer $TOKEN" -i sgrb2_files.txt
The token lasts ~48 h; re-run to get a fresh one.
"""
import globus_sdk

CLIENT_ID = "3b1925c0-a87b-452b-a492-2c9921d3bd14"   # Globus tutorial native client
COLLECTION = "d9873d5e-0fbd-4980-aedf-4ca56f65a045"  # JWST root

scope = f"https://auth.globus.org/scopes/{COLLECTION}/https"
client = globus_sdk.NativeAppAuthClient(CLIENT_ID)
client.oauth2_start_flow(requested_scopes=scope, refresh_tokens=False)
print("\n1. Open this URL in a browser and log in (ORCID works):\n")
print("   " + client.oauth2_get_authorize_url() + "\n")
code = input("2. Paste the authorization code here: ").strip()
tokens = client.oauth2_exchange_code_for_tokens(code)
token = tokens.by_resource_server[COLLECTION]["access_token"]
print("\nBearer token (valid ~48h):\n")
print(token)