from __future__ import annotations
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.orm import Session

from app.database import get_db
from app.auth import verify_password, create_access_token, hash_password, get_current_user
from app.models.user import AdminUser
from app.schemas.user import LoginRequest, LoginResponse, UserInfo, ChangePasswordRequest, CreateUserRequest, UpdateUserRequest, ResetPasswordRequest, UserListResponse

router = APIRouter(prefix="/api/auth", tags=["认证"])


@router.post("/login", response_model=LoginResponse)
def login(req: LoginRequest, db: Session = Depends(get_db)):
    user = db.query(AdminUser).filter(AdminUser.username == req.username).first()
    if not user or not verify_password(req.password, user.password_hash):
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="用户名或密码错误")
    if not user.is_active:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="账号已被禁用")
    token = create_access_token({"sub": user.username, "role": user.role})
    return LoginResponse(access_token=token)


@router.get("/me", response_model=UserInfo)
def get_me(current_user: AdminUser = Depends(get_current_user)):
    return current_user


@router.put("/password")
def change_password(req: ChangePasswordRequest, current_user: AdminUser = Depends(get_current_user), db: Session = Depends(get_db)):
    if not verify_password(req.old_password, current_user.password_hash):
        raise HTTPException(status_code=400, detail="原密码错误")
    current_user.password_hash = hash_password(req.new_password)
    db.commit()
    return {"message": "密码修改成功"}


# ===== 用户管理（仅 admin 角色可用）=====

def require_admin(current_user: AdminUser = Depends(get_current_user)):
    if current_user.role != "admin":
        raise HTTPException(status_code=403, detail="仅管理员可操作")
    return current_user


@router.get("/users", response_model=list[UserListResponse])
def list_users(db: Session = Depends(get_db), _: AdminUser = Depends(require_admin)):
    users = db.query(AdminUser).order_by(AdminUser.id).all()
    return [UserListResponse.model_validate(u) for u in users]


@router.post("/users", response_model=UserListResponse, status_code=201)
def create_user(req: CreateUserRequest, db: Session = Depends(get_db), _: AdminUser = Depends(require_admin)):
    if db.query(AdminUser).filter(AdminUser.username == req.username).first():
        raise HTTPException(status_code=400, detail="用户名已存在")
    user = AdminUser(
        username=req.username,
        password_hash=hash_password(req.password),
        display_name=req.display_name,
        role=req.role,
        is_active=True,
    )
    db.add(user)
    db.commit()
    db.refresh(user)
    return UserListResponse.model_validate(user)


@router.put("/users/{user_id}", response_model=UserListResponse)
def update_user(user_id: int, req: UpdateUserRequest, db: Session = Depends(get_db), _: AdminUser = Depends(require_admin)):
    user = db.query(AdminUser).get(user_id)
    if not user:
        raise HTTPException(status_code=404, detail="用户不存在")
    if req.display_name is not None:
        user.display_name = req.display_name
    if req.role is not None:
        user.role = req.role
    if req.is_active is not None:
        user.is_active = req.is_active
    db.commit()
    db.refresh(user)
    return UserListResponse.model_validate(user)


@router.put("/users/{user_id}/reset-password")
def reset_password(user_id: int, req: ResetPasswordRequest, db: Session = Depends(get_db), _: AdminUser = Depends(require_admin)):
    user = db.query(AdminUser).get(user_id)
    if not user:
        raise HTTPException(status_code=404, detail="用户不存在")
    user.password_hash = hash_password(req.new_password)
    db.commit()
    return {"message": f"已重置 {user.username} 的密码"}


@router.delete("/users/{user_id}")
def delete_user(user_id: int, db: Session = Depends(get_db), current_user: AdminUser = Depends(require_admin)):
    user = db.query(AdminUser).get(user_id)
    if not user:
        raise HTTPException(status_code=404, detail="用户不存在")
    if user.id == current_user.id:
        raise HTTPException(status_code=400, detail="不能删除自己")
    db.delete(user)
    db.commit()
    return {"message": "删除成功"}