from fastapi import APIRouter, Depends, HTTPException, Request
from sqlalchemy.orm import Session
from ..db import get_db
from ..models import User, Role
from ..security import hash_password, get_session_user_id

router = APIRouter(prefix="/admin", tags=["admin"])

def require_admin(req: Request, db: Session) -> User:
    uid = get_session_user_id(req)
    if not uid:
        raise HTTPException(status_code=401, detail="not logged in")
    user = db.query(User).filter(User.id == uid).first()
    if not user or user.role != Role.admin.value:
        raise HTTPException(status_code=403, detail="forbidden")
    return user

@router.get("/users")
def list_users(req: Request, db: Session = Depends(get_db)):
    require_admin(req, db)
    users = db.query(User).order_by(User.created_at.desc()).all()
    return [
        {
            "id": u.id,
            "email": u.email,
            "display_name": u.display_name,
            "role": u.role,
            "disabled": u.disabled,
        }
        for u in users
    ]

@router.post("/users")
def create_user(req: Request, data: dict, db: Session = Depends(get_db)):
    require_admin(req, db)
    email = (data.get("email") or "").lower().strip()
    password = data.get("password") or ""
    display_name = (data.get("display_name") or "").strip()

    if not email or not password:
        raise HTTPException(400, "email/password required")
    if db.query(User).filter(User.email == email).first():
        raise HTTPException(409, "email exists")

    role = data.get("role") or Role.user.value
    if role not in (Role.admin.value, Role.user.value):
        raise HTTPException(400, "invalid role")

    u = User(email=email, password_hash=hash_password(password), role=role, display_name=display_name)
    db.add(u); db.commit()
    return {"ok": True, "id": u.id}
    
@router.delete("/users/{user_id}")
def delete_user(req: Request, user_id: str, db: Session = Depends(get_db)):
    admin = require_admin(req, db)

    if admin.id == user_id:
        raise HTTPException(400, "cannot delete yourself")

    u = db.query(User).filter(User.id == user_id).first()
    if not u:
        raise HTTPException(404, "not found")

    # soft delete
    u.disabled = True
    db.add(u)
    db.commit()
    return {"ok": True}


@router.patch("/users/{user_id}")
def update_user(req: Request, user_id: str, data: dict, db: Session = Depends(get_db)):
    admin = require_admin(req, db)
    user = db.query(User).filter(User.id == user_id).first()
    if not user:
        raise HTTPException(404, "not found")

    email = (data.get("email") or user.email).lower().strip()
    display_name = (data.get("display_name") if "display_name" in data else user.display_name or "").strip()
    role = data.get("role") or user.role
    password = data.get("password") or ""

    if not email or "@" not in email:
        raise HTTPException(400, "valid email required")
    if role not in (Role.admin.value, Role.user.value):
        raise HTTPException(400, "invalid role")
    if password and len(password) < 8:
        raise HTTPException(400, "password too short (min 8)")
    if admin.id == user_id and role != Role.admin.value:
        raise HTTPException(400, "cannot demote yourself")
    if admin.id == user_id and data.get("disabled") is True:
        raise HTTPException(400, "cannot disable yourself")

    duplicate = db.query(User).filter(User.email == email, User.id != user_id).first()
    if duplicate:
        raise HTTPException(409, "email exists")

    user.email = email
    user.display_name = display_name
    user.role = role
    if password:
        user.password_hash = hash_password(password)
    if "disabled" in data:
        user.disabled = bool(data["disabled"])

    db.add(user)
    db.commit()
    return {"ok": True}