from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.database import get_db
from app.crud import audit as audit_crud
from app.crud import user as user_crud
from app.deps import get_current_user, require_permission
from app.models.user import User
from app.schemas.user import UserCreate, UserRead, UserUpdate

router = APIRouter()


@router.get("/me", response_model=UserRead)
async def read_me(user: User = Depends(get_current_user)):
    return user


@router.get("", response_model=list[UserRead])
async def list_users(
    skip: int = 0,
    limit: int = 100,
    db: AsyncSession = Depends(get_db),
    _: User = Depends(require_permission("users:read")),
):
    return await user_crud.list_users(db, skip=skip, limit=limit)


@router.post("", response_model=UserRead, status_code=status.HTTP_201_CREATED)
async def create_user(
    payload: UserCreate,
    db: AsyncSession = Depends(get_db),
    actor: User = Depends(require_permission("users:write")),
):
    if await user_crud.get_by_email(db, payload.email):
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT, detail="Email already registered"
        )
    created = await user_crud.create(
        db,
        email=payload.email,
        password=payload.password,
        full_name=payload.full_name,
        is_superuser=payload.is_superuser,
        role_ids=payload.role_ids,
    )
    await audit_crud.log(
        db,
        actor=actor,
        action="create",
        resource_type="User",
        resource_id=created.id,
        description=audit_crud.describe_create("User", created.id, created.email),
    )
    return created


@router.get("/{user_id}", response_model=UserRead)
async def get_user(
    user_id: int,
    db: AsyncSession = Depends(get_db),
    _: User = Depends(require_permission("users:read")),
):
    target = await user_crud.get(db, user_id)
    if target is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND, detail="User not found"
        )
    return target


@router.patch("/{user_id}", response_model=UserRead)
async def update_user(
    user_id: int,
    payload: UserUpdate,
    db: AsyncSession = Depends(get_db),
    actor: User = Depends(require_permission("users:write")),
):
    target = await user_crud.get(db, user_id)
    if target is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND, detail="User not found"
        )
    changes = payload.model_dump(exclude_unset=True)
    if "email" in changes:
        existing = await user_crud.get_by_email(db, changes["email"])
        if existing is not None and existing.id != target.id:
            raise HTTPException(
                status_code=status.HTTP_409_CONFLICT, detail="Email already registered"
            )
    target = await user_crud.update(db, target, changes)
    await audit_crud.log(
        db,
        actor=actor,
        action="update",
        resource_type="User",
        resource_id=user_id,
        description=audit_crud.describe_update("User", user_id, changes),
    )
    return target


@router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_user(
    user_id: int,
    db: AsyncSession = Depends(get_db),
    actor: User = Depends(require_permission("users:delete")),
):
    target = await user_crud.get(db, user_id)
    if target is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND, detail="User not found"
        )
    email = target.email
    await user_crud.delete(db, target)
    await audit_crud.log(
        db,
        actor=actor,
        action="delete",
        resource_type="User",
        resource_id=user_id,
        description=audit_crud.describe_delete("User", user_id, email),
    )