admin / Apex

from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy import select
from sqlalchemy.orm import Session

from app.core.database import get_db
from app.core.deps import audit, require_roles
from app.core.security import hash_password
from app.models import (
    ALL_ROLES,
    ROLE_ADMIN,
    ROLE_BID_MANAGER,
    ROLE_FINANCE,
    AuditLog,
    ComplianceFramework,
    EffortRule,
    SystemSetting,
    User,
    WorkflowTemplate,
)
from app.schemas import (
    EffortRuleIn,
    EffortRuleOut,
    FrameworkIn,
    FrameworkOut,
    UserCreate,
    UserOut,
    UserUpdate,
)

router = APIRouter(prefix="/api/admin", tags=["admin"])
admin_only = require_roles(ROLE_ADMIN)


# --- users ---
@router.get("/users", response_model=list[UserOut])
def list_users(db: Session = Depends(get_db), _: User = Depends(admin_only)):
    return db.execute(select(User).order_by(User.id)).scalars().all()


@router.post("/users", response_model=UserOut, status_code=201)
def create_user(body: UserCreate, db: Session = Depends(get_db), actor: User = Depends(admin_only)):
    if db.execute(select(User).where(User.email == body.email)).scalar_one_or_none():
        raise HTTPException(status.HTTP_409_CONFLICT, "Email already exists")
    for r in body.roles:
        if r not in ALL_ROLES:
            raise HTTPException(status.HTTP_400_BAD_REQUEST, f"Unknown role {r}")
    user = User(
        email=body.email,
        name=body.name,
        roles=body.roles,
        password_hash=hash_password(body.password),
        must_change_password=True,
    )
    db.add(user)
    db.commit()
    db.refresh(user)
    audit(db, actor, "user_created", "user", user.id, {"email": user.email, "roles": user.roles})
    return user


@router.patch("/users/{user_id}", response_model=UserOut)
def update_user(user_id: int, body: UserUpdate, db: Session = Depends(get_db), actor: User = Depends(admin_only)):
    user = db.get(User, user_id)
    if not user:
        raise HTTPException(404, "User not found")
    if body.name is not None:
        user.name = body.name
    if body.roles is not None:
        if ROLE_ADMIN in user.roles and ROLE_ADMIN not in body.roles and _last_admin(db, user.id):
            raise HTTPException(400, "Cannot remove the last administrator")
        user.roles = body.roles
    if body.is_active is not None:
        if not body.is_active and ROLE_ADMIN in user.roles and _last_admin(db, user.id):
            raise HTTPException(400, "Cannot deactivate the last administrator")
        user.is_active = body.is_active
    if body.password:
        user.password_hash = hash_password(body.password)
        user.must_change_password = True
    db.commit()
    db.refresh(user)
    audit(db, actor, "user_updated", "user", user.id)
    return user


@router.delete("/users/{user_id}")
def delete_user(user_id: int, db: Session = Depends(get_db), actor: User = Depends(admin_only)):
    user = db.get(User, user_id)
    if not user:
        raise HTTPException(404, "User not found")
    if user.id == actor.id:
        raise HTTPException(400, "You cannot delete your own account")
    if ROLE_ADMIN in user.roles and _last_admin(db, user.id):
        raise HTTPException(400, "Cannot delete the last administrator")
    user.is_active = False  # soft delete
    db.commit()
    audit(db, actor, "user_deleted", "user", user.id)
    return {"ok": True}


def _last_admin(db: Session, exclude_id: int) -> bool:
    admins = db.execute(select(User).where(User.is_active == True)).scalars().all()  # noqa: E712
    remaining = [u for u in admins if ROLE_ADMIN in u.roles and u.id != exclude_id]
    return len(remaining) == 0


# --- MFA enforcement toggle ---
@router.get("/settings/enforce-mfa")
def get_enforce_mfa(db: Session = Depends(get_db), _: User = Depends(admin_only)):
    row = db.get(SystemSetting, "enforce_mfa")
    return {"enabled": bool(row and row.value.get("enabled"))}


@router.put("/settings/enforce-mfa")
def set_enforce_mfa(payload: dict, db: Session = Depends(get_db), actor: User = Depends(admin_only)):
    row = db.get(SystemSetting, "enforce_mfa")
    if not row:
        row = SystemSetting(key="enforce_mfa", value={})
        db.add(row)
    row.value = {"enabled": bool(payload.get("enabled"))}
    db.commit()
    audit(db, actor, "enforce_mfa_set", "setting", "enforce_mfa", row.value)
    return row.value


# --- AI Integration (Assistant) toggle ---
@router.get("/settings/ai-assistant")
def get_ai_assistant(db: Session = Depends(get_db), _: User = Depends(admin_only)):
    from app.core.config import settings
    row = db.get(SystemSetting, "ai_assistant")
    return {"enabled": bool(row and row.value.get("enabled")), "ai_key_present": settings.ai_enabled}


@router.put("/settings/ai-assistant")
def set_ai_assistant(payload: dict, db: Session = Depends(get_db), actor: User = Depends(admin_only)):
    row = db.get(SystemSetting, "ai_assistant")
    if not row:
        row = SystemSetting(key="ai_assistant", value={})
        db.add(row)
    row.value = {"enabled": bool(payload.get("enabled"))}
    db.commit()
    audit(db, actor, "ai_assistant_set", "setting", "ai_assistant", row.value)
    return row.value


# --- frameworks ---
@router.get("/frameworks", response_model=list[FrameworkOut])
def list_frameworks(db: Session = Depends(get_db), _: User = Depends(admin_only)):
    return db.execute(select(ComplianceFramework).order_by(ComplianceFramework.name)).scalars().all()


@router.post("/frameworks", response_model=FrameworkOut, status_code=201)
def create_framework(body: FrameworkIn, db: Session = Depends(get_db), actor: User = Depends(admin_only)):
    fw = ComplianceFramework(**body.model_dump())
    db.add(fw)
    db.commit()
    db.refresh(fw)
    audit(db, actor, "framework_created", "framework", fw.id)
    return fw


@router.patch("/frameworks/{fw_id}", response_model=FrameworkOut)
def update_framework(fw_id: int, body: FrameworkIn, db: Session = Depends(get_db), actor: User = Depends(admin_only)):
    fw = db.get(ComplianceFramework, fw_id)
    if not fw:
        raise HTTPException(404, "Not found")
    for k, v in body.model_dump().items():
        setattr(fw, k, v)
    db.commit()
    db.refresh(fw)
    audit(db, actor, "framework_updated", "framework", fw.id)
    return fw


@router.delete("/frameworks/{fw_id}")
def delete_framework(fw_id: int, db: Session = Depends(get_db), actor: User = Depends(admin_only)):
    fw = db.get(ComplianceFramework, fw_id)
    if not fw:
        raise HTTPException(404, "Not found")
    db.delete(fw)
    db.commit()
    audit(db, actor, "framework_deleted", "framework", fw_id)
    return {"ok": True}


# --- effort rules (Module 3 config) — Administrator, Bid Manager or Finance ---
effort_editor = require_roles(ROLE_ADMIN, ROLE_BID_MANAGER, ROLE_FINANCE)


@router.get("/effort-rules", response_model=list[EffortRuleOut])
def list_rules(db: Session = Depends(get_db), _: User = Depends(effort_editor)):
    return db.execute(select(EffortRule).order_by(EffortRule.id)).scalars().all()


@router.post("/effort-rules", response_model=EffortRuleOut, status_code=201)
def create_rule(body: EffortRuleIn, db: Session = Depends(get_db), actor: User = Depends(effort_editor)):
    rule = EffortRule(**body.model_dump())
    db.add(rule)
    db.commit()
    db.refresh(rule)
    audit(db, actor, "effort_rule_created", "effort_rule", rule.id, {"name": rule.name})
    return rule


@router.patch("/effort-rules/{rule_id}", response_model=EffortRuleOut)
def update_rule(rule_id: int, body: EffortRuleIn, db: Session = Depends(get_db), actor: User = Depends(effort_editor)):
    rule = db.get(EffortRule, rule_id)
    if not rule:
        raise HTTPException(404, "Not found")
    for k, v in body.model_dump().items():
        setattr(rule, k, v)
    db.commit()
    db.refresh(rule)
    audit(db, actor, "effort_rule_updated", "effort_rule", rule.id, {"name": rule.name})
    return rule


@router.delete("/effort-rules/{rule_id}")
def delete_rule(rule_id: int, db: Session = Depends(get_db), actor: User = Depends(effort_editor)):
    rule = db.get(EffortRule, rule_id)
    if rule:
        db.delete(rule)
        db.commit()
        audit(db, actor, "effort_rule_deleted", "effort_rule", rule_id)
    return {"ok": True}


# --- workflow templates ---
@router.get("/workflows")
def list_workflows(db: Session = Depends(get_db), _: User = Depends(admin_only)):
    rows = db.execute(select(WorkflowTemplate)).scalars().all()
    return [{"id": w.id, "name": w.name, "is_default": w.is_default, "stages": w.stages, "milestones": w.milestones} for w in rows]


@router.patch("/workflows/{wf_id}")
def update_workflow(wf_id: int, payload: dict, db: Session = Depends(get_db), actor: User = Depends(admin_only)):
    wf = db.get(WorkflowTemplate, wf_id)
    if not wf:
        raise HTTPException(404, "Not found")
    for k in ("name", "stages", "milestones"):
        if k in payload:
            setattr(wf, k, payload[k])
    db.commit()
    audit(db, actor, "workflow_updated", "workflow", wf.id)
    return {"id": wf.id, "name": wf.name, "stages": wf.stages, "milestones": wf.milestones}


# --- audit log ---
@router.get("/audit")
def audit_log(limit: int = 200, db: Session = Depends(get_db), _: User = Depends(admin_only)):
    rows = db.execute(select(AuditLog).order_by(AuditLog.ts.desc()).limit(min(limit, 500))).scalars().all()
    return [
        {"id": r.id, "ts": r.ts, "actor": r.actor, "action": r.action,
         "entity": r.entity, "entity_id": r.entity_id, "detail": r.detail}
        for r in rows
    ]