from fastapi import APIRouter, Depends, HTTPException
from pydantic import BaseModel
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select, update, delete, func, text
from ..db import get_db
from ..models.users import User
from ..deps.auth import get_current_user
from passlib.hash import bcrypt
from datetime import datetime, timezone
import re
from ..config import now_bj

router = APIRouter()

ROLE_OVERRIDES: dict[str, str] = {}


class CreateUserRequest(BaseModel):
    username: str
    email: str
    role: str
    status: str
    sort: int = 0


class UpdateUserRequest(BaseModel):
    role: str | None = None
    status: str | None = None
    sort: int | None = None

class ChangePasswordRequest(BaseModel):
    currentPassword: str
    newPassword: str


def _status_to_active(status: str) -> bool:
    return status == "enabled"


def _active_to_status(active: bool) -> str:
    return "enabled" if active else "disabled"

async def _get_user_id(db: AsyncSession, username: str) -> int | None:
    res = await db.execute(text("SELECT id FROM users WHERE username=:u LIMIT 1"), {"u": username})
    row = res.first()
    return row[0] if row else None

async def _get_role_id(db: AsyncSession, role_key: str) -> int | None:
    res = await db.execute(text("SELECT id FROM roles WHERE role_key=:k LIMIT 1"), {"k": role_key})
    row = res.first()
    return row[0] if row else None

async def _get_role_key(db: AsyncSession, username: str) -> str | None:
    res = await db.execute(
        text(
            "SELECT r.role_key FROM roles r JOIN user_role_mapping m ON r.id=m.role_id JOIN users u ON u.id=m.user_id WHERE u.username=:u LIMIT 1"
        ),
        {"u": username},
    )
    row = res.first()
    return row[0] if row else None

async def _set_user_role(db: AsyncSession, username: str, role_key: str) -> bool:
    uid = await _get_user_id(db, username)
    if uid is None:
        return False
    rid = await _get_role_id(db, role_key)
    if rid is None:
        return False
    await db.execute(text("DELETE FROM user_role_mapping WHERE user_id=:uid"), {"uid": uid})
    await db.execute(text("INSERT INTO user_role_mapping(user_id, role_id) VALUES(:uid, :rid)"), {"uid": uid, "rid": rid})
    await db.commit()
    return True

def _role_or_default(username: str) -> str:
    if username in ROLE_OVERRIDES:
        return ROLE_OVERRIDES[username]
    if username == "admin":
        return "admin"
    if username == "ops":
        return "operator"
    if username == "obs":
        return "observer"
    return "observer"


def _get_username(u) -> str:
    return getattr(u, "username", None) or (u.get("username") if isinstance(u, dict) else None)


def _require_permission(user, permission: str):
    perms = user.get("permissions", []) if isinstance(user, dict) else getattr(user, "permissions", [])
    if permission not in perms:
        raise HTTPException(status_code=403, detail=f"Permission denied: {permission}")


@router.get("/users")
async def list_users(user=Depends(get_current_user), db: AsyncSession = Depends(get_db)):
    try:
        _require_permission(user, "auth:manage")
        result = await db.execute(select(User).order_by(User.sort.desc()).limit(500))
        rows = result.scalars().all()
        users = []
        for u in rows:
            rk = await _get_role_key(db, u.username)
            users.append(
                {
                    "username": u.username,
                    "email": u.email,
                    "role": rk or "observer",
                    "status": _active_to_status(u.is_active),
                    "sort": u.sort,
                }
            )
        return {"users": users}
    except HTTPException:
        raise
    except Exception:
        raise HTTPException(status_code=500, detail="server_error")


@router.post("/users")
async def create_user(req: CreateUserRequest, user=Depends(get_current_user), db: AsyncSession = Depends(get_db)):
    try:
        _require_permission(user, "auth:manage")
        errors: list[dict] = []
        if not (3 <= len(req.username) <= 50) or not re.fullmatch(r"^[A-Za-z][A-Za-z0-9_]{2,49}$", req.username or ""):
            errors.append({"field": "username", "message": "用户名需以字母开头，支持字母/数字/下划线，长度3-50"})
        if not re.fullmatch(r"^[^@\s]+@[^@\s]+\.[^@\s]+$", req.email or ""):
            errors.append({"field": "email", "message": "邮箱格式不正确"})
        if req.role not in {"admin", "operator", "observer"}:
            errors.append({"field": "role", "message": "角色必须为 admin/operator/observer"})
        if req.status not in {"enabled", "pending", "disabled"}:
            errors.append({"field": "status", "message": "状态必须为 enabled/pending/disabled"})
        if errors:
            raise HTTPException(status_code=400, detail={"errors": errors})

        exists_username = await db.execute(select(User.id).where(User.username == req.username).limit(1))
        if exists_username.scalars().first():
            raise HTTPException(status_code=409, detail={"errors": [{"field": "username", "message": "用户名已存在"}]})
        exists_email = await db.execute(select(User.id).where(User.email == req.email).limit(1))
        if exists_email.scalars().first():
            raise HTTPException(status_code=409, detail={"errors": [{"field": "email", "message": "邮箱已存在"}]})

        temp_password = "TempPass#123"
        password_hash = bcrypt.hash(temp_password)
        now = now_bj()
        user_obj = User(
            username=req.username,
            email=req.email,
            password_hash=password_hash,
            full_name=req.username,
            is_active=_status_to_active(req.status),
            sort=req.sort,
            last_login=None,
            created_at=now,
            updated_at=now,
        )
        db.add(user_obj)
        await db.flush()
        await db.commit()
        ok = await _set_user_role(db, req.username, req.role)
        if not ok:
            raise HTTPException(status_code=400, detail={"errors": [{"field": "role", "message": "角色不存在"}]})
        return {"ok": True}
    except HTTPException:
        raise
    except Exception:
        raise HTTPException(status_code=500, detail="server_error")


@router.patch("/users/{username}")
async def update_user(username: str, req: UpdateUserRequest, user=Depends(get_current_user), db: AsyncSession = Depends(get_db)):
    try:
        _require_permission(user, "auth:manage")
        result = await db.execute(select(User).where(User.username == username).limit(1))
        u = result.scalars().first()
        if not u:
            raise HTTPException(status_code=404, detail="not_found")
        updates = {}
        if req.status is not None:
            if req.status not in {"enabled", "disabled"}:
                raise HTTPException(status_code=400, detail="invalid_status")
            updates["is_active"] = _status_to_active(req.status)
        if req.sort is not None:
            updates["sort"] = req.sort
        if req.role is not None:
            if req.role not in {"admin", "operator", "observer"}:
                raise HTTPException(status_code=400, detail={"errors": [{"field": "role", "message": "不允许的角色"}]})
            ok = await _set_user_role(db, username, req.role)
            if not ok:
                raise HTTPException(status_code=400, detail={"errors": [{"field": "role", "message": "角色不存在"}]})
        if updates:
            updates["updated_at"] = func.now()
            await db.execute(update(User).where(User.id == u.id).values(**updates))
            await db.commit()
        return {"ok": True}
    except HTTPException:
        raise
    except Exception:
        raise HTTPException(status_code=500, detail="server_error")


@router.delete("/users/{username}")
async def delete_user(username: str, user=Depends(get_current_user), db: AsyncSession = Depends(get_db)):
    try:
        _require_permission(user, "auth:manage")
        result = await db.execute(select(User).where(User.username == username).limit(1))
        u = result.scalars().first()
        if not u:
            ROLE_OVERRIDES.pop(username, None)
            return {"ok": True}
        await db.execute(delete(User).where(User.id == u.id))
        await db.commit()
        ROLE_OVERRIDES.pop(username, None)
        return {"ok": True}
    except HTTPException:
        raise
    except Exception:
        raise HTTPException(status_code=500, detail="server_error")

@router.get("/users/with-roles")
async def list_users_with_roles(user=Depends(get_current_user), db: AsyncSession = Depends(get_db)):
    try:
        _require_admin(user)
        res = await db.execute(
            text(
                "SELECT u.username,u.email,u.is_active,r.role_key FROM users u LEFT JOIN user_role_mapping m ON u.id=m.user_id LEFT JOIN roles r ON r.id=m.role_id LIMIT 500"
            )
        )
        rows = res.all()
        users = [
            {
                "username": r[0],
                "email": r[1],
                "role": r[3] or "observer",
                "status": _active_to_status(r[2]),
            }
            for r in rows
        ]
        return {"users": users}
    except HTTPException:
        raise
    except Exception:
        raise HTTPException(status_code=500, detail="server_error")


@router.patch("/user/password")
async def change_password(req: ChangePasswordRequest, user=Depends(get_current_user), db: AsyncSession = Depends(get_db)):
    try:
        username = _get_username(user)
        # 演示账号保护
        if username in {"admin", "ops", "obs"}:
            raise HTTPException(status_code=400, detail="demo_user_cannot_change_password")

        # 密码强度校验
        if not (8 <= len(req.newPassword) <= 128) or not re.search(r"[A-Z]", req.newPassword) or not re.search(r"[a-z]", req.newPassword) or not re.search(r"\d", req.newPassword):
            raise HTTPException(status_code=400, detail="weak_new_password")

        # 查找真实用户
        res = await db.execute(select(User).where(User.username == username).limit(1))
        u = res.scalars().first()
        if not u:
            raise HTTPException(status_code=401, detail="user_not_found")

        # 验证旧密码
        if not bcrypt.verify(req.currentPassword, u.password_hash):
            raise HTTPException(status_code=400, detail="invalid_current_password")

        # 更新密码
        new_hash = bcrypt.hash(req.newPassword)
        await db.execute(update(User).where(User.id == u.id).values(password_hash=new_hash, updated_at=func.now()))
        await db.commit()
        return {"ok": True}
    except HTTPException:
        raise
    except Exception:
        raise HTTPException(status_code=500, detail="server_error")