from __future__ import annotations

from datetime import UTC, datetime

from fastapi import APIRouter, Request, Response, status

from app.core.config import get_settings
from app.core.errors import AppError
from app.schemas.auth import AuthLoginRequest, AuthSession, AuthSessionEnvelope
from app.services.auth_service import AuthService


router = APIRouter(prefix="/auth", tags=["auth"])
COOKIE_NAME = "geointel_session"


def _session_payload(request: Request) -> AuthSession:
    settings = get_settings()
    if not settings.auth_enabled:
        return AuthSession(authentication_required=False, authenticated=True)
    principal = AuthService.verify_session_token(request.cookies.get(COOKIE_NAME), settings)
    if principal is None:
        return AuthSession(authentication_required=True, authenticated=False)
    return AuthSession(
        authentication_required=True,
        authenticated=True,
        username=principal.username,
        expires_at=datetime.fromtimestamp(principal.expires_at, tz=UTC),
    )


@router.get("/session", response_model=AuthSessionEnvelope)
def session(request: Request) -> AuthSessionEnvelope:
    return AuthSessionEnvelope(data=_session_payload(request))


@router.post("/login", response_model=AuthSessionEnvelope)
def login(payload: AuthLoginRequest, request: Request, response: Response) -> AuthSessionEnvelope:
    settings = get_settings()
    if not settings.auth_enabled:
        raise AppError(
            code="AUTHENTICATION_DISABLED",
            message="Operator authentication is not enabled on this runtime",
            status_code=status.HTTP_409_CONFLICT,
        )
    client_host = request.client.host if request.client else "unknown"
    throttle_key = f"{client_host}:{payload.username.casefold()}"
    retry_after = AuthService.retry_after_seconds(throttle_key)
    if retry_after:
        raise AppError(
            code="LOGIN_RATE_LIMITED",
            message="Te veel mislukte aanmeldpogingen. Probeer later opnieuw.",
            details={"retry_after_seconds": retry_after},
            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
        )
    if not AuthService.credentials_match(payload.username, payload.password, settings):
        AuthService.record_failure(throttle_key)
        raise AppError(
            code="INVALID_CREDENTIALS",
            message="Gebruikersnaam of wachtwoord is onjuist.",
            status_code=status.HTTP_401_UNAUTHORIZED,
        )
    AuthService.clear_failures(throttle_key)
    token = AuthService.create_session_token(payload.username, settings)
    principal = AuthService.verify_session_token(token, settings)
    if principal is None:  # pragma: no cover - defensive invariant
        raise AppError(
            code="SESSION_CREATION_FAILED",
            message="De beveiligde sessie kon niet worden aangemaakt.",
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
        )
    forwarded_proto = request.headers.get("x-forwarded-proto", "").split(",", 1)[0].strip().lower()
    response.set_cookie(
        key=COOKIE_NAME,
        value=token,
        max_age=settings.auth_session_ttl_seconds,
        httponly=True,
        secure=forwarded_proto == "https" or request.url.scheme == "https",
        samesite="strict",
        path="/",
    )
    return AuthSessionEnvelope(
        data=AuthSession(
            authentication_required=True,
            authenticated=True,
            username=principal.username,
            expires_at=datetime.fromtimestamp(principal.expires_at, tz=UTC),
        )
    )


@router.post("/logout", response_model=AuthSessionEnvelope)
def logout(response: Response) -> AuthSessionEnvelope:
    response.delete_cookie(key=COOKIE_NAME, path="/", httponly=True, samesite="strict")
    return AuthSessionEnvelope(
        data=AuthSession(authentication_required=True, authenticated=False)
    )