"""Authentication endpoints."""

from fastapi import APIRouter, Depends, HTTPException, Request
from sqlmodel import Session, select

from ten31portal.auth import get_current_user, hash_password, verify_password
from ten31portal.database import get_session
from ten31portal.models import User
from ten31portal.schemas import ChangePasswordRequest, LoginRequest, UserResponse

router = APIRouter(prefix="/api/auth", tags=["auth"])


@router.post("/login")
def login(
    body: LoginRequest,
    request: Request,
    session: Session = Depends(get_session),
) -> UserResponse:
    # Accept either a username or an email in the login field.
    handle = body.login.strip()
    user = session.exec(select(User).where(User.username == handle)).first()
    if user is None:
        user = session.exec(select(User).where(User.email == handle)).first()
    if user is None or not verify_password(body.password, user.password_hash):
        raise HTTPException(status_code=401, detail="Invalid username or password")
    if user.primary_account_id is not None:
        raise HTTPException(
            status_code=401,
            detail="This account signs in under another login. Use that account's credentials.",
        )
    if not user.login_enabled:
        raise HTTPException(status_code=401, detail="This account does not have a login yet.")
    if not user.is_active:
        raise HTTPException(status_code=401, detail="Account disabled")
    request.session["user_id"] = user.id
    return UserResponse.model_validate(user, from_attributes=True)


@router.post("/logout")
def logout(request: Request) -> dict[str, str]:
    request.session.clear()
    return {"status": "ok"}


@router.get("/me")
def me(user: User = Depends(get_current_user)) -> UserResponse:
    return UserResponse.model_validate(user, from_attributes=True)


@router.post("/change-password")
def change_password(
    body: ChangePasswordRequest,
    user: User = Depends(get_current_user),
    session: Session = Depends(get_session),
) -> dict[str, str]:
    """Let the signed-in user set their own password (after confirming the current one)."""
    if not verify_password(body.current_password, user.password_hash):
        raise HTTPException(status_code=400, detail="Current password is incorrect.")
    if len(body.new_password) < 4:
        raise HTTPException(status_code=400, detail="New password must be at least 4 characters.")
    user.password_hash = hash_password(body.new_password)
    session.add(user)
    session.commit()
    return {"status": "ok"}