import sys
sys.path.insert(0, "/var/www/html/metafoliadorv2")

from fastapi import APIRouter, Request, Depends, HTTPException
from fastapi.responses import JSONResponse, RedirectResponse
from sqlalchemy.orm import Session
from pydantic import BaseModel, Field
from typing import Optional

from app.models.main_database import get_main_db
from app.models.main_user import MainUser
from app.models.main_customer import Customer
from app.services.main_auth_service import (
    main_hash_password,
    main_verify_password,
    main_create_access_token,
    main_decode_access_token,
)

router = APIRouter(prefix="/main/api/auth", tags=["main-auth"])


def get_main_current_user(request: Request, db: Session = Depends(get_main_db)):
    token = request.cookies.get("main_access_token")
    if not token:
        raise HTTPException(status_code=401, detail="No autenticado")
    payload = main_decode_access_token(token)
    if not payload:
        raise HTTPException(status_code=401, detail="Token invalido")
    user = db.query(MainUser).filter(
        MainUser.id == payload.get("user_id"),
        MainUser.active == True,
    ).first()
    if not user:
        inactive = db.query(MainUser).filter(
            MainUser.id == payload.get("user_id"),
            MainUser.active == False,
        ).first()
        detail = "Cuenta desactivada" if inactive else "Usuario no encontrado"
        raise HTTPException(status_code=401, detail=detail)
    return user


class MainLoginRequest(BaseModel):
    email: str
    password: str


@router.post("/login", summary="Iniciar sesión principal", description="Autentica al usuario administrador del panel principal.")
async def main_login(body: MainLoginRequest, request: Request, db: Session = Depends(get_main_db)):
    user = db.query(MainUser).filter(MainUser.email == body.email, MainUser.active == True).first()
    if not user or not main_verify_password(body.password, user.password_hash):
        return JSONResponse({"error": "Credenciales invalidas"}, status_code=401)

    token = main_create_access_token({"user_id": user.id, "email": user.email})
    response = JSONResponse({"ok": True, "user": {"name": user.name, "email": user.email}})
    response.set_cookie(
        key="main_access_token",
        value=token,
        httponly=True,
        secure=True,
        samesite="lax",
        max_age=28800,
    )
    return response


@router.post("/logout", summary="Cerrar sesión principal")
async def main_logout():
    response = JSONResponse({"ok": True})
    response.delete_cookie("main_access_token")
    return response


@router.get("/me", summary="Perfil del usuario principal")
async def main_me(current_user: MainUser = Depends(get_main_current_user)):
    return {
        "id": current_user.id,
        "name": current_user.name,
        "email": current_user.email,
    }


@router.post("/seed", status_code=201, summary="Crear admin inicial", description="Crea el usuario administrador inicial del panel principal si no existe. Idempotente.")
async def main_seed_admin(db: Session = Depends(get_main_db)):
    existing = db.query(MainUser).filter(MainUser.email == "admin@metafoliador.com").first()
    if existing:
        return {"ok": True, "message": "El admin ya existe", "email": existing.email}
    admin = MainUser(
        email="admin@metafoliador.com",
        password_hash=main_hash_password("Admin123!"),
        name="Administrador",
        active=True,
    )
    db.add(admin)
    db.commit()
    db.refresh(admin)
    return {"ok": True, "message": "Admin creado exitosamente", "email": admin.email}