admin / Bid-Sentinel

"""Tender endpoints: listing, bid-status updates, manual add, scrape trigger."""
import json
import re
import uuid
from datetime import datetime, timedelta, timezone

from fastapi import APIRouter, Depends, HTTPException, Query, status
from sqlalchemy import delete, or_, select
from sqlalchemy.exc import IntegrityError
from sqlalchemy.ext.asyncio import AsyncSession

from app import ai, analysis
from app.appsettings import get_ai_enabled
from app.database import get_db
from app.deps import get_current_admin, get_current_user
from app.models import (
    BidStatus,
    Comment,
    DeletedOpportunity,
    SuppressedOpportunity,
    Tender,
    User,
    UserRole,
)
from app.schemas import (
    BidStatusUpdate,
    BulkDeleteRequest,
    BulkDeleteResult,
    CommentCreate,
    CommentOut,
    DeleteResult,
    OutcomeUpdate,
    ScrapeResult,
    TenderCreate,
    TenderOut,
    TenderUpdate,
    UndoResult,
)
from app.scraper.base import parse_value
from app.scraper.runner import run_all_scrapers

router = APIRouter(prefix="/tenders", tags=["tenders"])

# How long a deleted opportunity can be restored via Undo before it's pruned.
_UNDO_RETENTION = timedelta(days=14)

# Tender columns captured in a deletion snapshot (enough to fully restore it).
_SNAPSHOT_FIELDS = (
    "reference", "url", "title", "description", "published_date", "closing_date",
    "value_amount", "value_text", "currency", "duration", "buyer", "source",
    "matched_keyword", "bid_status", "outcome", "required_certs", "fit_score",
    "fit_matched", "tech_requirements", "ai_summary", "created_at",
)


def _snapshot(t: Tender) -> str:
    """Serialise a tender's restorable fields to JSON."""
    data = {}
    for field in _SNAPSHOT_FIELDS:
        value = getattr(t, field)
        if isinstance(value, datetime):
            value = value.isoformat()
        elif isinstance(value, BidStatus):
            value = value.value
        data[field] = value
    return json.dumps(data)


def _restore_kwargs(snapshot: str) -> dict:
    """Turn a snapshot back into Tender(**kwargs)."""
    data = json.loads(snapshot)
    for field in ("published_date", "closing_date", "created_at"):
        if data.get(field):
            try:
                data[field] = datetime.fromisoformat(data[field])
            except (ValueError, TypeError):
                data[field] = None
    if data.get("bid_status"):
        try:
            data["bid_status"] = BidStatus(data["bid_status"])
        except ValueError:
            data["bid_status"] = BidStatus.pending
    return data


async def _prune_old_archives(db: AsyncSession) -> None:
    """Drop undo snapshots past the retention window (keeps the table small)."""
    cutoff = datetime.now(timezone.utc) - _UNDO_RETENTION
    await db.execute(delete(DeletedOpportunity).where(DeletedOpportunity.created_at < cutoff))


# Whitelist of sortable columns -> ORM attribute.
_SORT_COLUMNS = {
    "published_date": Tender.published_date,
    "closing_date": Tender.closing_date,
    "value_amount": Tender.value_amount,
    "fit_score": Tender.fit_score,
    "title": Tender.title,
    "created_at": Tender.created_at,
}


@router.get("", response_model=list[TenderOut])
async def list_tenders(
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
    bid_status: BidStatus | None = Query(default=None),
    source: str | None = Query(default=None, description="Filter by portal/source name"),
    search: str | None = Query(default=None, description="Free-text title/buyer search"),
    sort_by: str = Query(default="published_date", description="Sort column"),
    order: str = Query(default="desc", pattern="^(asc|desc)$"),
    limit: int = Query(default=500, le=2000),
    offset: int = Query(default=0, ge=0),
):
    stmt = select(Tender)

    if bid_status is not None:
        stmt = stmt.where(Tender.bid_status == bid_status)
    if source:
        stmt = stmt.where(Tender.source == source)
    if search:
        like = f"%{search.strip()}%"
        stmt = stmt.where(or_(Tender.title.ilike(like), Tender.buyer.ilike(like)))

    column = _SORT_COLUMNS.get(sort_by, Tender.published_date)
    direction = column.asc() if order == "asc" else column.desc()
    # nullslast keeps undated/valueless rows at the bottom; id keeps it stable.
    stmt = stmt.order_by(direction.nullslast(), Tender.id.desc())

    stmt = stmt.limit(limit).offset(offset)
    result = await db.execute(stmt)
    return result.scalars().all()


@router.post("", response_model=TenderOut, status_code=status.HTTP_201_CREATED)
async def create_tender(
    payload: TenderCreate,
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    """Manually add an opportunity that wasn't scraped.

    Gets the same cert/fit/requirement analysis (and AI summary if enabled) as
    scraped opportunities. A URL is optional — a placeholder is generated if blank.
    """
    title = payload.title.strip()
    if not title:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Title is required")

    url = (payload.url or "").strip()
    if url:
        if not re.match(r"^https?://", url, re.IGNORECASE):
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="URL must start with http:// or https:// (or leave it blank)",
            )
        exists = (await db.execute(select(Tender.id).where(Tender.url == url))).first()
        if exists:
            raise HTTPException(
                status_code=status.HTTP_409_CONFLICT,
                detail="An opportunity with that URL already exists",
            )
    else:
        url = f"manual:{uuid.uuid4()}"  # synthetic unique key for the not-null/unique column

    amount, value_text = parse_value(payload.value)
    capability_terms = await analysis.get_capability_terms(db)
    use_ai = await get_ai_enabled(db)
    fields = await ai.analyze_opportunity(
        f"{title}\n{payload.description or ''}", capability_terms, use_ai
    )

    tender = Tender(
        url=url,
        title=title[:1024],
        description=payload.description,
        buyer=(payload.buyer or "").strip() or None,
        value_amount=amount,
        value_text=value_text,
        duration=(payload.duration or "").strip() or None,
        published_date=payload.published_date,
        closing_date=payload.closing_date,
        source="Manual entry",
        required_certs=fields["required_certs"],
        fit_score=fields["fit_score"],
        fit_matched=fields["fit_matched"],
        tech_requirements=fields["tech_requirements"],
        ai_summary=fields.get("ai_summary", ""),
    )
    db.add(tender)
    await db.commit()
    await db.refresh(tender)
    return tender


@router.patch("/{tender_id}", response_model=TenderOut)
async def edit_tender(
    tender_id: int,
    payload: TenderUpdate,
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    """Edit an opportunity's details. Only fields supplied are changed; the
    cert/fit/requirement analysis is re-run afterwards."""
    tender = await db.get(Tender, tender_id)
    if not tender:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Tender not found")

    sent = payload.model_dump(exclude_unset=True)

    if "title" in sent:
        title = (payload.title or "").strip()
        if not title:
            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Title cannot be empty")
        tender.title = title[:1024]

    if "url" in sent and payload.url is not None:
        url = payload.url.strip()
        if url:
            if not re.match(r"^https?://", url, re.IGNORECASE):
                raise HTTPException(
                    status_code=status.HTTP_400_BAD_REQUEST,
                    detail="URL must start with http:// or https://",
                )
            clash = (
                await db.execute(
                    select(Tender.id).where(Tender.url == url, Tender.id != tender_id)
                )
            ).first()
            if clash:
                raise HTTPException(
                    status_code=status.HTTP_409_CONFLICT, detail="Another opportunity has that URL"
                )
            tender.url = url[:1024]
        # blank url on edit -> keep the existing url unchanged

    if "buyer" in sent:
        tender.buyer = (payload.buyer or "").strip() or None
    if "duration" in sent:
        tender.duration = (payload.duration or "").strip() or None
    if "description" in sent:
        tender.description = payload.description
    if "value" in sent:
        tender.value_amount, tender.value_text = parse_value(payload.value)
    if "published_date" in sent:
        tender.published_date = payload.published_date
    if "closing_date" in sent:
        tender.closing_date = payload.closing_date

    # Re-run analysis (title/description may have changed).
    capability_terms = await analysis.get_capability_terms(db)
    use_ai = await get_ai_enabled(db)
    fields = await ai.analyze_opportunity(
        f"{tender.title}\n{tender.description or ''}", capability_terms, use_ai
    )
    tender.required_certs = fields["required_certs"]
    tender.fit_score = fields["fit_score"]
    tender.fit_matched = fields["fit_matched"]
    tender.tech_requirements = fields["tech_requirements"]
    tender.ai_summary = fields.get("ai_summary", "")

    await db.commit()
    await db.refresh(tender)
    return tender


@router.delete("/{tender_id}", response_model=DeleteResult)
async def delete_tender(
    tender_id: int,
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    """Delete an opportunity entirely (e.g. scraped in error). Comments cascade.

    A snapshot is archived under the returned ``batch_id`` so the deletion can be
    undone via POST /tenders/undo/{batch_id}.
    """
    tender = await db.get(Tender, tender_id)
    if not tender:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Tender not found")

    batch_id = uuid.uuid4().hex
    await _prune_old_archives(db)
    db.add(
        DeletedOpportunity(batch_id=batch_id, snapshot=_snapshot(tender), suppressed=False)
    )
    await db.delete(tender)
    await db.commit()
    return DeleteResult(batch_id=batch_id)


@router.post("/bulk-delete", response_model=BulkDeleteResult)
async def bulk_delete_tenders(
    payload: BulkDeleteRequest,
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Delete several opportunities at once AND block them from future scrapes.

    Each deleted opportunity's url/reference is recorded on the suppression list
    so the scraper never inserts it again. Comments cascade with the tender.
    """
    batch_id = uuid.uuid4().hex
    if not payload.ids:
        return BulkDeleteResult(deleted=0, suppressed=0, batch_id=batch_id)

    result = await db.execute(select(Tender).where(Tender.id.in_(payload.ids)))
    tenders = list(result.scalars().all())

    # Existing suppression keys, so we don't add duplicates.
    existing = await db.execute(select(SuppressedOpportunity.url, SuppressedOpportunity.reference))
    blocked_urls: set[str] = set()
    blocked_refs: set[str] = set()
    for url, ref in existing.all():
        if url:
            blocked_urls.add(url)
        if ref:
            blocked_refs.add(ref)

    await _prune_old_archives(db)
    deleted = suppressed = 0
    for t in tenders:
        # Only block real scraped links (not the "manual:" placeholder URLs).
        url = t.url if t.url and not t.url.startswith("manual:") else None
        did_suppress = False
        if (url and url not in blocked_urls) or (t.reference and t.reference not in blocked_refs):
            db.add(
                SuppressedOpportunity(
                    url=url, reference=t.reference, title=t.title[:1024], batch_id=batch_id
                )
            )
            if url:
                blocked_urls.add(url)
            if t.reference:
                blocked_refs.add(t.reference)
            suppressed += 1
            did_suppress = True
        # Snapshot for Undo (restores the tender and lifts its suppression).
        db.add(
            DeletedOpportunity(batch_id=batch_id, snapshot=_snapshot(t), suppressed=did_suppress)
        )
        await db.delete(t)
        deleted += 1

    await db.commit()
    return BulkDeleteResult(deleted=deleted, suppressed=suppressed, batch_id=batch_id)


@router.post("/undo/{batch_id}", response_model=UndoResult)
async def undo_delete(
    batch_id: str,
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    """Restore opportunities deleted in a given batch and lift any suppression.

    Works for both single and bulk deletes. Comments are not restored.
    """
    archived = list(
        (
            await db.execute(
                select(DeletedOpportunity).where(DeletedOpportunity.batch_id == batch_id)
            )
        ).scalars().all()
    )
    if not archived:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="Nothing to undo — this deletion has expired or was already restored.",
        )

    restored = 0
    for row in archived:
        kwargs = _restore_kwargs(row.snapshot)
        try:
            # Savepoint so a single clash (e.g. re-scraped meanwhile) doesn't
            # abort the whole restore.
            async with db.begin_nested():
                db.add(Tender(**kwargs))
                await db.flush()
            restored += 1
        except IntegrityError:
            pass  # already exists again; skip this one

    # Lift suppression created by this batch, and clear the archive rows.
    await db.execute(
        delete(SuppressedOpportunity).where(SuppressedOpportunity.batch_id == batch_id)
    )
    await db.execute(delete(DeletedOpportunity).where(DeletedOpportunity.batch_id == batch_id))
    await db.commit()
    return UndoResult(restored=restored)


@router.patch("/{tender_id}/status", response_model=TenderOut)
async def update_bid_status(
    tender_id: int,
    payload: BidStatusUpdate,
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    """Inline bid-status update. Setting 'No Bid' defaults the outcome to 'No Bid'."""
    tender = await db.get(Tender, tender_id)
    if not tender:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Tender not found")

    tender.bid_status = payload.bid_status
    if payload.bid_status == BidStatus.no_bid:
        tender.outcome = "No Bid"  # default the outcome to No Bid
    elif tender.outcome == "No Bid":
        tender.outcome = "Awaiting"  # clear a now-stale No Bid outcome
    await db.commit()
    await db.refresh(tender)
    return tender


@router.patch("/{tender_id}/outcome", response_model=TenderOut)
async def update_outcome(
    tender_id: int,
    payload: OutcomeUpdate,
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    """Inline bid-outcome update (Won / Lost / Awaiting) from the table."""
    tender = await db.get(Tender, tender_id)
    if not tender:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Tender not found")

    tender.outcome = payload.outcome.value
    await db.commit()
    await db.refresh(tender)
    return tender


@router.post("/scrape", response_model=ScrapeResult)
async def trigger_scrape(
    db: AsyncSession = Depends(get_db),
    _admin: User = Depends(get_current_admin),
):
    """Manually run all scrapers now (admin only)."""
    summary = await run_all_scrapers(db)
    return ScrapeResult(**summary)


# --- Comments ---------------------------------------------------------------
@router.get("/{tender_id}/comments", response_model=list[CommentOut])
async def list_comments(
    tender_id: int,
    db: AsyncSession = Depends(get_db),
    _user: User = Depends(get_current_user),
):
    result = await db.execute(
        select(Comment).where(Comment.tender_id == tender_id).order_by(Comment.created_at)
    )
    return result.scalars().all()


@router.post("/{tender_id}/comments", response_model=CommentOut, status_code=status.HTTP_201_CREATED)
async def add_comment(
    tender_id: int,
    payload: CommentCreate,
    db: AsyncSession = Depends(get_db),
    user: User = Depends(get_current_user),
):
    body = payload.body.strip()
    if not body:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Comment is empty")
    if not await db.get(Tender, tender_id):
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Tender not found")

    comment = Comment(tender_id=tender_id, author_email=user.email, body=body)
    db.add(comment)
    await db.commit()
    await db.refresh(comment)
    return comment


@router.delete(
    "/{tender_id}/comments/{comment_id}", status_code=status.HTTP_204_NO_CONTENT
)
async def delete_comment(
    tender_id: int,
    comment_id: int,
    db: AsyncSession = Depends(get_db),
    user: User = Depends(get_current_user),
):
    comment = await db.get(Comment, comment_id)
    if not comment or comment.tender_id != tender_id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Comment not found")
    # Author or admin may delete.
    if comment.author_email != user.email and user.role != UserRole.admin:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not allowed")
    await db.delete(comment)
    await db.commit()