admin / Strike

import os
import re
import uuid
from datetime import date

from fastapi import APIRouter, Depends, HTTPException, Request, UploadFile, File, Form
from fastapi.responses import FileResponse
from sqlalchemy.orm import Session

from .. import models, schemas, scoring, pdf_report, itsm, risk
from ..database import get_db
from ..security import get_current_user, require_admin, client_ip, write_audit

router = APIRouter(prefix="/api/assessments", tags=["assessments"])

# Uploaded evidence files are persisted in a named volume (see docker-compose).
EVIDENCE_DIR = "/app/evidence"
MAX_EVIDENCE_BYTES = 25 * 1024 * 1024  # 25 MB per file


def _safe_name(name: str) -> str:
    """Strip path components and unsafe characters from an uploaded filename."""
    base = os.path.basename(name or "file")
    return re.sub(r"[^A-Za-z0-9._-]", "_", base)[:120] or "file"


def _get_owned(db: Session, assessment_id: uuid.UUID, user: models.User) -> models.Assessment:
    a = db.query(models.Assessment).filter(models.Assessment.id == assessment_id).first()
    if not a:
        raise HTTPException(status_code=404, detail="Assessment not found")
    if a.user_id != user.id and user.role != "admin":
        raise HTTPException(status_code=403, detail="Not permitted")
    return a


@router.get("", response_model=list[schemas.AssessmentOut])
def list_assessments(db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    q = db.query(models.Assessment)
    if user.role != "admin":
        q = q.filter(models.Assessment.user_id == user.id)
    return q.order_by(models.Assessment.created_at.desc()).all()


@router.post("", response_model=schemas.AssessmentOut)
def create_assessment(payload: schemas.AssessmentCreate, request: Request,
                      db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    framework = db.query(models.Framework).filter(
        models.Framework.id == payload.framework_id,
        models.Framework.is_active == True).first()  # noqa: E712
    if not framework:
        raise HTTPException(status_code=400, detail="Unknown or inactive framework")
    a = models.Assessment(
        user_id=user.id,
        framework_id=framework.id,
        organisation_name=payload.organisation_name,
        assessment_date=payload.assessment_date or date.today(),
        status="in_progress",
    )
    db.add(a)
    db.commit()
    db.refresh(a)
    write_audit(db, user.username, "ASSESSMENT_STARTED",
                f"org={a.organisation_name} framework={framework.id} id={a.id}", client_ip(request))
    return a


@router.get("/{assessment_id}")
def get_assessment(assessment_id: uuid.UUID, db: Session = Depends(get_db),
                   user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    answers = {
        str(ans.question_id): str(ans.option_id)
        for ans in db.query(models.AssessmentAnswer).filter(
            models.AssessmentAnswer.assessment_id == a.id).all()
    }
    obj_scores = {
        s.objective_id: float(s.score)
        for s in db.query(models.AssessmentObjectiveScore).filter(
            models.AssessmentObjectiveScore.assessment_id == a.id).all()
    }
    principles = {p.id: p for p in db.query(models.CafPrinciple).all()}
    principle_scores = []
    for ps in db.query(models.AssessmentPrincipleScore).filter(
            models.AssessmentPrincipleScore.assessment_id == a.id).all():
        pr = principles.get(ps.principle_id)
        principle_scores.append({
            "principle_id": ps.principle_id,
            "principle_title": pr.title if pr else "",
            "objective_id": pr.objective_id if pr else "",
            "score": float(ps.score),
        })
    principle_scores.sort(key=lambda x: (x["objective_id"], x["principle_id"]))

    # v3: framework metadata + ordered objective list so the UI can render any
    # framework's results without assuming the CAF A-D objectives.
    framework = db.query(models.Framework).filter(
        models.Framework.id == a.framework_id).first()
    objectives = [
        {"id": o.id, "title": o.title}
        for o in db.query(models.CafObjective)
        .filter(models.CafObjective.framework_id == a.framework_id)
        .order_by(models.CafObjective.sort_order).all()
    ]
    revision_count = (db.query(models.AssessmentRevision)
                      .filter(models.AssessmentRevision.assessment_id == a.id).count())
    return {
        "id": str(a.id), "organisation_name": a.organisation_name,
        "assessment_date": a.assessment_date.isoformat(), "status": a.status,
        "framework_id": a.framework_id,
        "framework_name": framework.name if framework else a.framework_id,
        "objectives": objectives,
        "overall_score": float(a.overall_score) if a.overall_score is not None else None,
        "answers": answers, "objective_scores": obj_scores,
        "principle_scores": principle_scores,
        "revision_count": revision_count,
    }


@router.put("/{assessment_id}/answers")
def save_answers(assessment_id: uuid.UUID, payload: schemas.AnswersSubmit,
                 db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    """Save/pause: upsert answers without completing the assessment."""
    a = _get_owned(db, assessment_id, user)
    for ans in payload.answers:
        existing = db.query(models.AssessmentAnswer).filter(
            models.AssessmentAnswer.assessment_id == a.id,
            models.AssessmentAnswer.question_id == ans.question_id).first()
        if existing:
            existing.option_id = ans.option_id
        else:
            db.add(models.AssessmentAnswer(
                assessment_id=a.id, question_id=ans.question_id, option_id=ans.option_id))
    db.commit()
    return {"detail": "Saved", "count": len(payload.answers)}


@router.post("/{assessment_id}/complete")
def complete_assessment(assessment_id: uuid.UUID, request: Request,
                        db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    result = scoring.compute_and_persist(db, a, triggered_by=user.username)
    write_audit(db, user.username, "ASSESSMENT_COMPLETED",
                f"id={a.id} score={result['overall_score']} rev={result['revision_no']}",
                client_ip(request))
    return result


@router.post("/{assessment_id}/rescore")
def rescore_assessment(assessment_id: uuid.UUID, request: Request,
                       db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    """Re-score a previously completed assessment after evidence/answer updates.

    The previous scores+answers are retained as an immutable revision; this
    appends a new revision and returns both the previous and the new score.
    """
    a = _get_owned(db, assessment_id, user)
    previous = float(a.overall_score) if a.overall_score is not None else None
    result = scoring.compute_and_persist(db, a, triggered_by=user.username)
    write_audit(db, user.username, "ASSESSMENT_RESCORED",
                f"id={a.id} previous={previous} new={result['overall_score']} rev={result['revision_no']}",
                client_ip(request))
    return {"previous_overall": previous, "current_overall": result["overall_score"],
            **result}


@router.get("/{assessment_id}/revisions", response_model=list[schemas.RevisionOut])
def list_revisions(assessment_id: uuid.UUID, db: Session = Depends(get_db),
                   user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    return (db.query(models.AssessmentRevision)
            .filter(models.AssessmentRevision.assessment_id == a.id)
            .order_by(models.AssessmentRevision.revision_no).all())


# ---------- Evidence & notes (v3) ----------
def _validate_question(db: Session, a: models.Assessment, question_id):
    """Ensure an evidence note/file targets a question in this assessment's framework."""
    if question_id is None:
        return None
    q = db.query(models.Question).filter(models.Question.id == question_id).first()
    if not q:
        raise HTTPException(status_code=400, detail="Unknown question")
    pr = db.query(models.CafPrinciple).filter(models.CafPrinciple.id == q.principle_id).first()
    if not pr or pr.framework_id != a.framework_id:
        raise HTTPException(status_code=400, detail="Question is not part of this assessment")
    return q.id


@router.get("/{assessment_id}/evidence", response_model=list[schemas.EvidenceOut])
def list_evidence(assessment_id: uuid.UUID, db: Session = Depends(get_db),
                  user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    return (db.query(models.AssessmentEvidence)
            .filter(models.AssessmentEvidence.assessment_id == a.id)
            .order_by(models.AssessmentEvidence.created_at.desc()).all())


@router.post("/{assessment_id}/notes", response_model=schemas.EvidenceOut)
def add_note(assessment_id: uuid.UUID, payload: schemas.NoteIn, request: Request,
             db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    """Add a text note (assessment-level, or against a question)."""
    a = _get_owned(db, assessment_id, user)
    if not payload.content or not payload.content.strip():
        raise HTTPException(status_code=400, detail="Note content is required")
    qid = _validate_question(db, a, payload.question_id)
    ev = models.AssessmentEvidence(
        assessment_id=a.id, question_id=qid, kind="note",
        content=payload.content.strip(), created_by=user.username)
    db.add(ev)
    db.commit()
    db.refresh(ev)
    write_audit(db, user.username, "NOTE_ADDED",
                f"assessment={a.id} question={qid or 'assessment-level'}", client_ip(request))
    return ev


@router.post("/{assessment_id}/evidence", response_model=schemas.EvidenceOut)
def upload_evidence(assessment_id: uuid.UUID, request: Request,
                    file: UploadFile = File(...),
                    question_id: str = Form(None), description: str = Form(None),
                    db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    """Upload an evidence file (assessment-level, or against a question)."""
    a = _get_owned(db, assessment_id, user)
    qid = _validate_question(db, a, uuid.UUID(question_id)) if question_id else None

    data = file.file.read()
    if len(data) > MAX_EVIDENCE_BYTES:
        raise HTTPException(status_code=413, detail="File exceeds 25 MB limit")
    if not data:
        raise HTTPException(status_code=400, detail="Empty file")

    safe = _safe_name(file.filename)
    dest_dir = os.path.join(EVIDENCE_DIR, str(a.id))
    os.makedirs(dest_dir, exist_ok=True)
    stored = f"{uuid.uuid4().hex}_{safe}"
    dest_path = os.path.join(dest_dir, stored)
    with open(dest_path, "wb") as fh:
        fh.write(data)

    ev = models.AssessmentEvidence(
        assessment_id=a.id, question_id=qid, kind="evidence",
        content=(description.strip() if description else None),
        file_name=safe, file_path=dest_path,
        mime_type=file.content_type, file_size=len(data),
        created_by=user.username)
    db.add(ev)
    db.commit()
    db.refresh(ev)
    write_audit(db, user.username, "EVIDENCE_ADDED",
                f"assessment={a.id} file={safe} size={len(data)} question={qid or 'assessment-level'}",
                client_ip(request))
    return ev


@router.get("/{assessment_id}/evidence/{evidence_id}/download")
def download_evidence(assessment_id: uuid.UUID, evidence_id: uuid.UUID,
                      db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    ev = db.query(models.AssessmentEvidence).filter(
        models.AssessmentEvidence.id == evidence_id,
        models.AssessmentEvidence.assessment_id == a.id).first()
    if not ev or ev.kind != "evidence" or not ev.file_path or not os.path.exists(ev.file_path):
        raise HTTPException(status_code=404, detail="Evidence file not found")
    return FileResponse(ev.file_path, filename=ev.file_name,
                        media_type=ev.mime_type or "application/octet-stream")


@router.get("/{assessment_id}/risk")
def get_risk_summary(assessment_id: uuid.UUID, db: Session = Depends(get_db),
                     user: models.User = Depends(get_current_user)):
    """Risk assessment summary derived from the assessment responses."""
    a = _get_owned(db, assessment_id, user)
    return risk.build_risk_summary(db, a)


@router.delete("/{assessment_id}")
def delete_assessment(assessment_id: uuid.UUID, request: Request,
                      db: Session = Depends(get_db),
                      admin: models.User = Depends(require_admin)):
    """Admin-only: permanently delete an assessment and its child rows."""
    a = db.query(models.Assessment).filter(models.Assessment.id == assessment_id).first()
    if not a:
        raise HTTPException(status_code=404, detail="Assessment not found")
    org = a.organisation_name
    db.delete(a)  # cascades to answers / scores / actions
    db.commit()
    write_audit(db, admin.username, "ASSESSMENT_DELETED",
                f"org='{org}' id={assessment_id}", client_ip(request))
    return {"detail": "Assessment deleted"}


@router.get("/{assessment_id}/roadmap")
def get_roadmap(assessment_id: uuid.UUID, db: Session = Depends(get_db),
                user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    sugg = {s.id: s for s in db.query(models.RemediationSuggestion).all()}
    actions = db.query(models.RemediationAction).filter(
        models.RemediationAction.assessment_id == a.id).all()
    principles = {p.id: p for p in db.query(models.CafPrinciple).all()}
    items = []
    for act in actions:
        s = sugg.get(act.remediation_id)
        pr = principles.get(act.principle_id)
        items.append({
            "principle_id": act.principle_id,
            "principle_title": pr.title if pr else "",
            "objective_id": pr.objective_id if pr else "",
            "principle_score": float(act.principle_score),
            "title": s.title if s else "", "detail": s.detail if s else "",
            "priority": s.priority if s else 99, "effort": s.effort if s else "",
            "status": act.status, "external_ref": act.external_ref,
        })
    items.sort(key=lambda x: (x["priority"], x["principle_score"]))
    return items


@router.post("/{assessment_id}/report")
def export_report(assessment_id: uuid.UUID, meta: schemas.ReportMeta, request: Request,
                  db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    """Confirm org name + date, then generate the PDF report."""
    a = _get_owned(db, assessment_id, user)
    if a.status != "completed":
        raise HTTPException(status_code=400, detail="Complete the assessment before exporting")
    if meta.organisation_name:
        a.organisation_name = meta.organisation_name
    if meta.assessment_date:
        a.assessment_date = meta.assessment_date
    db.commit()
    path = pdf_report.generate_report(db, a)
    write_audit(db, user.username, "PDF_EXPORTED", f"id={a.id}", client_ip(request))
    return {"detail": "Report generated", "path": path}


@router.get("/{assessment_id}/report/download")
def download_report(assessment_id: uuid.UUID, db: Session = Depends(get_db),
                    user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    path = pdf_report.generate_report(db, a)
    return FileResponse(path, media_type="application/pdf",
                        filename=f"StrikeXi_Report_{a.organisation_name}.pdf")


@router.post("/{assessment_id}/push-itsm")
def push_to_itsm(assessment_id: uuid.UUID, request: Request, system: str = "log",
                 db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    """Future-proofing endpoint: push roadmap items to Jira/ServiceNow (stubbed)."""
    a = _get_owned(db, assessment_id, user)
    results = itsm.push_actions(db, a.id, system=system)
    write_audit(db, user.username, "ITSM_PUSH", f"id={a.id} system={system} count={len(results)}",
                client_ip(request))
    return {"pushed": results}