admin / Bid-Sentinel

"""Configuration endpoints: portals, keywords, schedule, capability profile."""
import asyncio
import re

from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status
from sqlalchemy import select
from sqlalchemy.exc import IntegrityError
from sqlalchemy.ext.asyncio import AsyncSession

from app import ai, analysis
from app.appsettings import (
    AI_ENABLED_KEY,
    CPV_STRICT_KEY,
    get_ai_enabled,
    get_cpv_strict,
    set_setting,
)
from app.config import settings
from app.database import get_db
from app.deps import get_current_admin, get_current_user
from app.models import (
    Accreditation,
    CapabilityTerm,
    CpvCode,
    CustomKeyword,
    Portal,
    ScheduleSlot,
    Tender,
    TuneOutTerm,
    User,
)
from app.schemas import (
    AccreditationCreate,
    AccreditationOut,
    AiConfig,
    AiUpdate,
    CapabilityCreate,
    CapabilityList,
    CapabilityOut,
    CapabilityUploadResult,
    CpvCreate,
    CpvOut,
    CpvStrictConfig,
    CpvUpdate,
    KeywordCreate,
    TuneOutAddResult,
    TuneOutCreate,
    TuneOutOut,
    KeywordList,
    KeywordOut,
    PortalCreate,
    PortalOut,
    PortalUpdate,
    RecomputeResult,
    ScheduleInfo,
    ScheduleSlotCreate,
    ScheduleSlotOut,
    ScheduleSlotToggle,
)
from app.scraper.base import normalize_cpv
from app.scraper.keywords import CYBER_KEYWORDS, matches_tuneout
from app.scraper.portals import PORTALS_BY_KEY
from app.scraper.scheduler import compute_next_run

router = APIRouter(prefix="/config", tags=["config"])

# Max upload size for capability documents (5 MB).
_MAX_UPLOAD_BYTES = 5 * 1024 * 1024


# --- Portals ----------------------------------------------------------------
@router.get("/portals", response_model=list[PortalOut])
async def list_portals(
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    result = await db.execute(select(Portal).order_by(Portal.id))
    return result.scalars().all()


@router.patch("/portals/{key}", response_model=PortalOut)
async def toggle_portal(
    key: str,
    payload: PortalUpdate,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    portal = (await db.execute(select(Portal).where(Portal.key == key))).scalar_one_or_none()
    if not portal:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Portal not found")
    portal.enabled = payload.enabled
    await db.commit()
    await db.refresh(portal)
    return portal


def _slugify(name: str) -> str:
    slug = re.sub(r"[^a-z0-9]+", "_", name.lower()).strip("_")
    return slug or "portal"


@router.post("/portals", response_model=PortalOut, status_code=status.HTTP_201_CREATED)
async def add_portal(
    payload: PortalCreate,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Register a custom portal (no automated scraper; selectable & schedulable)."""
    name = payload.name.strip()
    url = payload.url.strip()
    if not name:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Name is required")
    if not re.match(r"^https?://", url, re.IGNORECASE):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="URL must start with http:// or https://",
        )

    key = _slugify(name)
    if key in PORTALS_BY_KEY:
        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="A built-in portal has that name")
    if (await db.execute(select(Portal).where(Portal.key == key))).scalar_one_or_none():
        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="A portal with that name already exists")

    portal = Portal(
        key=key,
        name=name,
        url=url[:1024],
        scope=(payload.scope or "").strip() or None,
        live=False,  # custom portals have no automated scraper
        enabled=True,
        custom=True,
    )
    db.add(portal)
    await db.commit()
    await db.refresh(portal)
    return portal


@router.delete("/portals/{key}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_portal(
    key: str,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Delete a custom portal. Built-in portals can be disabled but not deleted."""
    portal = (await db.execute(select(Portal).where(Portal.key == key))).scalar_one_or_none()
    if not portal:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Portal not found")
    if not portal.custom or key in PORTALS_BY_KEY:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Built-in portals cannot be deleted — disable them with the toggle instead.",
        )
    await db.delete(portal)
    await db.commit()


# --- Keywords ---------------------------------------------------------------
@router.get("/keywords", response_model=KeywordList)
async def list_keywords(
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    result = await db.execute(select(CustomKeyword).order_by(CustomKeyword.id))
    return KeywordList(builtin=CYBER_KEYWORDS, custom=list(result.scalars().all()))


@router.post("/keywords", response_model=KeywordOut, status_code=status.HTTP_201_CREATED)
async def add_keyword(
    payload: KeywordCreate,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    keyword = payload.keyword.strip()
    if not keyword:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Keyword is empty")
    if keyword.lower() in {k.lower() for k in CYBER_KEYWORDS}:
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT, detail="Keyword is already built-in"
        )
    row = CustomKeyword(keyword=keyword)
    db.add(row)
    try:
        await db.commit()
    except IntegrityError:
        await db.rollback()
        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Keyword already exists")
    await db.refresh(row)
    return row


@router.delete("/keywords/{keyword_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_keyword(
    keyword_id: int,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    row = await db.get(CustomKeyword, keyword_id)
    if not row:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Keyword not found")
    await db.delete(row)
    await db.commit()


# --- CPV codes (scrape criteria) --------------------------------------------
@router.get("/cpv", response_model=list[CpvOut])
async def list_cpv_codes(
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    result = await db.execute(select(CpvCode).order_by(CpvCode.id))
    return result.scalars().all()


@router.post("/cpv", response_model=CpvOut, status_code=status.HTTP_201_CREATED)
async def add_cpv_code(
    payload: CpvCreate,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Add a CPV code (+ optional description) to the scrape criteria."""
    code = normalize_cpv(payload.code)
    if not code:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Enter a valid CPV code (digits, e.g. 72500000).",
        )
    row = CpvCode(code=code, description=(payload.description or "").strip())
    db.add(row)
    try:
        await db.commit()
    except IntegrityError:
        await db.rollback()
        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="CPV code already added")
    await db.refresh(row)
    return row


@router.get("/cpv-strict", response_model=CpvStrictConfig)
async def get_cpv_strict_config(
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    return CpvStrictConfig(strict=await get_cpv_strict(db))


@router.patch("/cpv-strict", response_model=CpvStrictConfig)
async def set_cpv_strict_config(
    payload: CpvStrictConfig,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Strict = require a CPV match from every notice (even those with no CPV data).
    Lenient (default) = only narrow notices that actually declare a CPV code."""
    await set_setting(db, CPV_STRICT_KEY, "true" if payload.strict else "false")
    return CpvStrictConfig(strict=payload.strict)


@router.patch("/cpv/{cpv_id}", response_model=CpvOut)
async def toggle_cpv_code(
    cpv_id: int,
    payload: CpvUpdate,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Enable/disable a CPV code. Disabled codes stay in the list but are not
    applied to the scrape criteria."""
    row = await db.get(CpvCode, cpv_id)
    if not row:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="CPV code not found")
    row.enabled = payload.enabled
    await db.commit()
    await db.refresh(row)
    return row


@router.delete("/cpv/{cpv_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_cpv_code(
    cpv_id: int,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    row = await db.get(CpvCode, cpv_id)
    if not row:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="CPV code not found")
    await db.delete(row)
    await db.commit()


# --- Tune-out list (negative filter) ----------------------------------------
@router.get("/tuneout", response_model=list[TuneOutOut])
async def list_tuneout(
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    result = await db.execute(select(TuneOutTerm).order_by(TuneOutTerm.id))
    return result.scalars().all()


@router.post("/tuneout", response_model=TuneOutAddResult, status_code=status.HTTP_201_CREATED)
async def add_tuneout(
    payload: TuneOutCreate,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Add a tune-out term and immediately remove matching NON-cyber opportunities.

    Cyber-security-related opportunities are never removed (see matches_tuneout).
    The term persists so these types do not reappear on future scrapes.
    """
    term = payload.term.strip()
    if not term:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Term is empty")

    row = TuneOutTerm(term=term)
    db.add(row)
    try:
        await db.commit()
    except IntegrityError:
        await db.rollback()
        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Term already tuned out")
    await db.refresh(row)

    # Purge existing opportunities matching this term (guardrail keeps cyber ones).
    tenders = list((await db.execute(select(Tender))).scalars().all())
    removed = 0
    for t in tenders:
        if matches_tuneout(t.title, t.description, [term]):
            await db.delete(t)
            removed += 1
    if removed:
        await db.commit()

    return TuneOutAddResult(term=row, removed=removed)


@router.delete("/tuneout/{term_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_tuneout(
    term_id: int,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Remove a tune-out term (lets that type back in on the next scrape)."""
    row = await db.get(TuneOutTerm, term_id)
    if not row:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Term not found")
    await db.delete(row)
    await db.commit()


# --- Schedule ---------------------------------------------------------------
@router.get("/schedule", response_model=ScheduleInfo)
async def get_schedule(
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    result = await db.execute(
        select(ScheduleSlot).order_by(ScheduleSlot.day_of_week, ScheduleSlot.hour, ScheduleSlot.minute)
    )
    slots = list(result.scalars().all())
    enabled = [s for s in slots if s.enabled]
    return ScheduleInfo(
        timezone=settings.schedule_timezone,
        slots=slots,
        next_run=compute_next_run(enabled),
    )


@router.post("/schedule", response_model=list[ScheduleSlotOut], status_code=status.HTTP_201_CREATED)
async def add_schedule_slots(
    payload: ScheduleSlotCreate,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Create the cartesian product of the chosen days x times (idempotent)."""
    if not payload.days or not payload.times:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST, detail="Provide at least one day and one time"
        )

    created: list[ScheduleSlot] = []
    for day in payload.days:
        if day < 0 or day > 6:
            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=f"Invalid day {day}")
        for t in payload.times:
            try:
                hh, mm = t.split(":")
                hour, minute = int(hh), int(mm)
                assert 0 <= hour <= 23 and 0 <= minute <= 59
            except (ValueError, AssertionError):
                raise HTTPException(
                    status_code=status.HTTP_400_BAD_REQUEST, detail=f"Invalid time '{t}' (use HH:MM)"
                )

            exists = (
                await db.execute(
                    select(ScheduleSlot).where(
                        ScheduleSlot.day_of_week == day,
                        ScheduleSlot.hour == hour,
                        ScheduleSlot.minute == minute,
                    )
                )
            ).scalar_one_or_none()
            if exists:
                continue
            slot = ScheduleSlot(day_of_week=day, hour=hour, minute=minute, enabled=True)
            db.add(slot)
            created.append(slot)

    await db.commit()
    for slot in created:
        await db.refresh(slot)
    return created


@router.patch("/schedule/{slot_id}", response_model=ScheduleSlotOut)
async def toggle_schedule_slot(
    slot_id: int,
    payload: ScheduleSlotToggle,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    slot = await db.get(ScheduleSlot, slot_id)
    if not slot:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Slot not found")
    slot.enabled = payload.enabled
    await db.commit()
    await db.refresh(slot)
    return slot


@router.delete("/schedule/{slot_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_schedule_slot(
    slot_id: int,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    slot = await db.get(ScheduleSlot, slot_id)
    if not slot:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Slot not found")
    await db.delete(slot)
    await db.commit()


# --- Capability profile (fit scoring) ---------------------------------------
@router.get("/capabilities", response_model=CapabilityList)
async def list_capabilities(
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    result = await db.execute(select(CapabilityTerm).order_by(CapabilityTerm.id))
    return CapabilityList(terms=list(result.scalars().all()))


@router.post("/capabilities", response_model=CapabilityOut, status_code=status.HTTP_201_CREATED)
async def add_capability(
    payload: CapabilityCreate,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    term = payload.term.strip()
    if not term:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Term is empty")
    row = CapabilityTerm(term=term)
    db.add(row)
    try:
        await db.commit()
    except IntegrityError:
        await db.rollback()
        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Term already exists")
    await db.refresh(row)
    return row


@router.delete("/capabilities/{term_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_capability(
    term_id: int,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    row = await db.get(CapabilityTerm, term_id)
    if not row:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Term not found")
    await db.delete(row)
    await db.commit()


@router.post("/capabilities/upload", response_model=CapabilityUploadResult)
async def upload_capability_doc(
    file: UploadFile = File(...),
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Parse a service-overview document and SUGGEST capability terms.

    Nothing is saved automatically — the suggestions are returned for the admin
    to confirm via POST /config/capabilities. Supports PDF / DOCX / TXT.
    """
    data = await file.read()
    if len(data) > _MAX_UPLOAD_BYTES:
        raise HTTPException(status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE, detail="File too large (max 5 MB)")

    text = analysis.extract_text(file.filename or "", data)
    if not text.strip():
        raise HTTPException(
            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
            detail="Could not extract text. Use a PDF, DOCX, or TXT with selectable text.",
        )

    # Generate suggestions from the document — AI when enabled, else keyphrase rules.
    generated_by = "keyword extraction"
    suggested = None
    if await get_ai_enabled(db) and ai.is_available():
        suggested = await ai.suggest_capabilities(text)
        if suggested is not None:
            generated_by = "AI"
    if suggested is None:
        suggested = analysis.suggest_capability_terms(text)

    # Don't re-suggest terms already in the profile.
    existing = {t.lower() for t in await analysis.get_capability_terms(db)}
    suggested = [t for t in suggested if t.lower() not in existing]

    return CapabilityUploadResult(
        filename=file.filename or "document",
        extracted_chars=len(text),
        suggested=suggested,
        detected_certs=analysis.detect_certs(text),
        generated_by=generated_by,
    )


@router.get("/certs", response_model=list[str])
async def list_cert_lexicon(_user: User = Depends(get_current_user)):
    """The certifications/accreditations Bid Sentinel watches for (informational)."""
    return analysis.CERT_NAMES


# --- Accreditations held (powers cert-gap analysis) -------------------------
@router.get("/accreditations", response_model=list[AccreditationOut])
async def list_accreditations(
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    result = await db.execute(select(Accreditation).order_by(Accreditation.id))
    return result.scalars().all()


@router.post("/accreditations", response_model=AccreditationOut, status_code=status.HTTP_201_CREATED)
async def add_accreditation(
    payload: AccreditationCreate,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    name = payload.name.strip()
    if not name:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Name is empty")
    row = Accreditation(name=name)
    db.add(row)
    try:
        await db.commit()
    except IntegrityError:
        await db.rollback()
        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Already listed")
    await db.refresh(row)
    return row


@router.delete("/accreditations/{acc_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_accreditation(
    acc_id: int,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    row = await db.get(Accreditation, acc_id)
    if not row:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not found")
    await db.delete(row)
    await db.commit()


@router.post("/recompute", response_model=RecomputeResult)
async def recompute_analysis(
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Re-run analysis (AI if enabled, else deterministic) across all opportunities.

    Run after changing the capability profile or toggling AI so existing rows
    pick up the new results. New tenders are analysed automatically at scrape time.
    """
    terms = await analysis.get_capability_terms(db)
    use_ai = await get_ai_enabled(db)
    tenders = list((await db.execute(select(Tender))).scalars().all())

    # Analysis calls don't touch the DB session, so compute with bounded concurrency.
    sem = asyncio.Semaphore(5)

    async def compute(t: Tender):
        async with sem:
            text = f"{t.title or ''}\n{t.description or ''}"
            return t, await ai.analyze_opportunity(text, terms, use_ai)

    for t, fields in await asyncio.gather(*(compute(t) for t in tenders)):
        t.required_certs = fields["required_certs"]
        t.fit_score = fields["fit_score"]
        t.fit_matched = fields["fit_matched"]
        t.tech_requirements = fields["tech_requirements"]
        t.ai_summary = fields.get("ai_summary", "")
    await db.commit()

    how = "AI (Claude)" if (use_ai and ai.is_available()) else "deterministic rules"
    return RecomputeResult(
        updated=len(tenders),
        message=f"Recomputed {len(tenders)} opportunities using {how} "
        f"and {len(terms)} capability term(s).",
    )


# --- AI bolt-on -------------------------------------------------------------
@router.get("/ai", response_model=AiConfig)
async def get_ai_config(
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    return AiConfig(
        enabled=await get_ai_enabled(db),
        available=ai.is_available(),
        model=settings.ai_model,
    )


@router.patch("/ai", response_model=AiConfig)
async def set_ai_config(
    payload: AiUpdate,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    if payload.enabled and not ai.is_available():
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="No ANTHROPIC_API_KEY configured — set it in the environment to enable AI.",
        )
    await set_setting(db, AI_ENABLED_KEY, "true" if payload.enabled else "false")
    return AiConfig(enabled=payload.enabled, available=ai.is_available(), model=settings.ai_model)