from fastapi import APIRouter, Depends, HTTPException
from sqlalchemy.orm import Session

from app.core.security import (
    create_access_token,
    get_access_token_expire_seconds,
    verify_password,
)
from app.core.rbac import get_current_active_user, get_user_permission_names
from app.db.database import get_db
from app.models.user import User
from app.repositories.user_repository import UserRepository
from app.schemas.rbac import CurrentUserResponse
from app.schemas.user import LoginRequest, LoginResponse

router = APIRouter(
    prefix="/auth",
    tags=["Authentication"],
)


@router.post("/login", response_model=LoginResponse)
def login(
    login: LoginRequest,
    db: Session = Depends(get_db),
):
    user = UserRepository.get_by_username(db, login.username)

    if not user:
        raise HTTPException(
            status_code=401,
            detail="Ungültige Anmeldedaten",
        )

    if not verify_password(login.password, user.password_hash):
        raise HTTPException(
            status_code=401,
            detail="Ungültige Anmeldedaten",
        )

    token = create_access_token(user.username)

    return {
        "access_token": token,
        "token_type": "bearer",
        "expires_in": get_access_token_expire_seconds(),
        "user": user,
    }


@router.get("/me", response_model=CurrentUserResponse)
def me(current_user: User = Depends(get_current_active_user)):
    return {
        "id": current_user.id,
        "username": current_user.username,
        "email": current_user.email,
        "role": current_user.primary_role.name,
        "permissions": sorted(get_user_permission_names(current_user)),
    }