from fastapi import APIRouter, Depends, HTTPException, status
from pydantic import BaseModel
from sqlalchemy.orm import Session
from ..database import get_db
from ..models import User, RolePagePermission
from ..auth import verify_password, create_access_token, hash_password
from ..schemas import LoginRequest, Token, UserOut
from ..dependencies import get_current_user

router = APIRouter()


class BootstrapBody(BaseModel):
    username: str
    password: str
    full_name: str = "Super Administrator"


@router.post("/bootstrap-super-admin")
def bootstrap_super_admin(body: BootstrapBody, db: Session = Depends(get_db)):
    """Create the first SUPER_ADMIN. Fails with 409 if one already exists."""
    if db.query(User).filter(User.role == 'SUPER_ADMIN').first():
        raise HTTPException(409, "A SUPER_ADMIN already exists")
    if db.query(User).filter(User.username == body.username).first():
        raise HTTPException(400, "Username already taken")
    u = User(
        username=body.username,
        password_hash=hash_password(body.password),
        role='SUPER_ADMIN',
        full_name=body.full_name,
        is_active=True,
    )
    db.add(u)
    db.commit()
    db.refresh(u)
    return {"id": u.id, "username": u.username, "role": u.role}


@router.post("/login", response_model=Token)
def login(body: LoginRequest, db: Session = Depends(get_db)):
    user = db.query(User).filter(
        User.username == body.username,
        User.is_active == True
    ).first()
    if not user or not verify_password(body.password, user.password_hash):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect username or password",
        )
    token = create_access_token(user.id, user.username, user.role)
    return {"access_token": token, "token_type": "bearer"}


@router.get("/me")
def me(current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
    if current_user.role == 'SUPER_ADMIN':
        accessible_modules = ['*']
    else:
        rows = db.query(RolePagePermission).filter_by(
            role=current_user.role, can_access=True
        ).all()
        accessible_modules = [r.module for r in rows]
    return {
        'id':                 current_user.id,
        'username':           current_user.username,
        'role':               current_user.role,
        'full_name':          current_user.full_name,
        'contact':            current_user.contact,
        'is_active':          current_user.is_active,
        'created_at':         current_user.created_at,
        'accessible_modules': accessible_modules,
    }