"""Server side of a Playmez embed (Python 3.8+, requests). Copy into your backend.

The API key stays here, never in a page or an app.

    launch = launch_playmez_game(game="ludo", external_user_id=str(user.id), display_name=user.name)
    return JsonResponse({"launchUrl": launch["launchUrl"]})
"""
import os

import requests

PLAYMEZ_API = os.environ.get("PLAYMEZ_API", "https://api.playmez.com")
PLAYMEZ_API_KEY = os.environ["PLAYMEZ_API_KEY"]  # spk_…


def launch_playmez_game(game: str, external_user_id: str, display_name: str | None = None, avatar: str | None = None) -> dict:
    payload = {"game": game, "externalUserId": external_user_id}
    if display_name:
        payload["displayName"] = display_name
    if avatar:
        payload["avatar"] = avatar
    res = requests.post(
        f"{PLAYMEZ_API}/partner/launch",
        json=payload,
        headers={"X-Api-Key": PLAYMEZ_API_KEY},
        timeout=10,
    )
    body = res.json()
    if not res.ok:
        raise RuntimeError(f"Playmez launch failed: {body.get('code', res.status_code)} {body.get('message', '')}")
    return body  # launchUrl, launchToken, expiresAt, game, player