from fastapi import APIRouter, Depends, HTTPException, Header
from typing import Optional

from .. import database as db
from ..auth import authenticate, get_user_from_token, hash_password, ensure_admin_exists

router = APIRouter(prefix="/api/auth", tags=["auth"])


def require_user(authorization: Optional[str] = Header(None)):
    if not authorization or not authorization.startswith("Bearer "):
        raise HTTPException(401, "Not authenticated")
    user = get_user_from_token(authorization[7:])
    if not user:
        raise HTTPException(401, "Invalid or expired token")
    return user


def require_admin(user: dict = Depends(require_user)):
    if not user["is_admin"]:
        raise HTTPException(403, "Admin access required")
    return user


@router.post("/login")
def login(body: dict):
    username = body.get("username", "").strip()
    password = body.get("password", "")
    if not username or not password:
        raise HTTPException(400, "Username and password are required")
    result = authenticate(username, password)
    if not result:
        raise HTTPException(401, "Invalid username or password")
    return result


@router.post("/register")
def register(body: dict, admin: dict = Depends(require_admin)):
    username = body.get("username", "").strip()
    password = body.get("password", "")
    if not username or not password:
        raise HTTPException(400, "Username and password are required")
    if len(password) < 4:
        raise HTTPException(400, "Password must be at least 4 characters")
    existing = db.get_user_by_username(username)
    if existing:
        raise HTTPException(409, "Username already exists")
    user = db.create_user(username, hash_password(password))
    return {"id": user["id"], "username": user["username"]}


@router.post("/reset-password")
def reset_password(body: dict, admin: dict = Depends(require_admin)):
    user_id = body.get("user_id", "").strip()
    new_password = body.get("new_password", "")
    if not user_id or not new_password:
        raise HTTPException(400, "user_id and new_password are required")
    if len(new_password) < 4:
        raise HTTPException(400, "Password must be at least 4 characters")
    user = db.get_user(user_id)
    if not user:
        raise HTTPException(404, "User not found")
    db.update_user_password(user_id, hash_password(new_password))
    return {"ok": True}


@router.get("/me")
def me(user: dict = Depends(require_user)):
    user["is_admin"] = bool(user["is_admin"])
    return user


@router.get("/users")
def list_users(admin: dict = Depends(require_admin)):
    return db.list_users()