import base64, hmac, hashlib, json, time

def _b64url(b: bytes) -> str:
    return base64.urlsafe_b64encode(b).decode().rstrip("=")

def _b64urldecode(s: str) -> bytes:
    pad = "=" * ((4 - (len(s) % 4)) % 4)
    return base64.urlsafe_b64decode(s + pad)

def make_media_token(filename: str, secret: str, ttl_seconds: int) -> str:
    exp = int(time.time()) + int(ttl_seconds)
    payload = {"f": filename, "exp": exp}
    payload_b = json.dumps(payload, separators=(",", ":"), ensure_ascii=False).encode()
    sig = hmac.new(secret.encode(), payload_b, hashlib.sha256).digest()
    return f"{_b64url(payload_b)}.{_b64url(sig)}"

def verify_media_token(token: str, secret: str):
    try:
        p, s = token.split(".", 1)
        payload_b = _b64urldecode(p)
        sig = _b64urldecode(s)
        expected = hmac.new(secret.encode(), payload_b, hashlib.sha256).digest()
        if not hmac.compare_digest(sig, expected):
            return None
        payload = json.loads(payload_b.decode())
        if int(payload.get("exp", 0)) < int(time.time()):
            return None
        return payload
    except Exception:
        return None