admin / Strike

import uuid
from datetime import date

from fastapi import APIRouter, Depends, HTTPException, Request
from fastapi.responses import FileResponse
from sqlalchemy.orm import Session

from .. import models, schemas, scoring, pdf_report, itsm, risk
from ..database import get_db
from ..security import get_current_user, require_admin, client_ip, write_audit

router = APIRouter(prefix="/api/assessments", tags=["assessments"])


def _get_owned(db: Session, assessment_id: uuid.UUID, user: models.User) -> models.Assessment:
    a = db.query(models.Assessment).filter(models.Assessment.id == assessment_id).first()
    if not a:
        raise HTTPException(status_code=404, detail="Assessment not found")
    if a.user_id != user.id and user.role != "admin":
        raise HTTPException(status_code=403, detail="Not permitted")
    return a


@router.get("", response_model=list[schemas.AssessmentOut])
def list_assessments(db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    q = db.query(models.Assessment)
    if user.role != "admin":
        q = q.filter(models.Assessment.user_id == user.id)
    return q.order_by(models.Assessment.created_at.desc()).all()


@router.post("", response_model=schemas.AssessmentOut)
def create_assessment(payload: schemas.AssessmentCreate, request: Request,
                      db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    a = models.Assessment(
        user_id=user.id,
        organisation_name=payload.organisation_name,
        assessment_date=payload.assessment_date or date.today(),
        status="in_progress",
    )
    db.add(a)
    db.commit()
    db.refresh(a)
    write_audit(db, user.username, "ASSESSMENT_STARTED",
                f"org={a.organisation_name} id={a.id}", client_ip(request))
    return a


@router.get("/{assessment_id}")
def get_assessment(assessment_id: uuid.UUID, db: Session = Depends(get_db),
                   user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    answers = {
        str(ans.question_id): str(ans.option_id)
        for ans in db.query(models.AssessmentAnswer).filter(
            models.AssessmentAnswer.assessment_id == a.id).all()
    }
    obj_scores = {
        s.objective_id: float(s.score)
        for s in db.query(models.AssessmentObjectiveScore).filter(
            models.AssessmentObjectiveScore.assessment_id == a.id).all()
    }
    principles = {p.id: p for p in db.query(models.CafPrinciple).all()}
    principle_scores = []
    for ps in db.query(models.AssessmentPrincipleScore).filter(
            models.AssessmentPrincipleScore.assessment_id == a.id).all():
        pr = principles.get(ps.principle_id)
        principle_scores.append({
            "principle_id": ps.principle_id,
            "principle_title": pr.title if pr else "",
            "objective_id": pr.objective_id if pr else "",
            "score": float(ps.score),
        })
    principle_scores.sort(key=lambda x: (x["objective_id"], x["principle_id"]))
    return {
        "id": str(a.id), "organisation_name": a.organisation_name,
        "assessment_date": a.assessment_date.isoformat(), "status": a.status,
        "overall_score": float(a.overall_score) if a.overall_score is not None else None,
        "answers": answers, "objective_scores": obj_scores,
        "principle_scores": principle_scores,
    }


@router.put("/{assessment_id}/answers")
def save_answers(assessment_id: uuid.UUID, payload: schemas.AnswersSubmit,
                 db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    """Save/pause: upsert answers without completing the assessment."""
    a = _get_owned(db, assessment_id, user)
    for ans in payload.answers:
        existing = db.query(models.AssessmentAnswer).filter(
            models.AssessmentAnswer.assessment_id == a.id,
            models.AssessmentAnswer.question_id == ans.question_id).first()
        if existing:
            existing.option_id = ans.option_id
        else:
            db.add(models.AssessmentAnswer(
                assessment_id=a.id, question_id=ans.question_id, option_id=ans.option_id))
    db.commit()
    return {"detail": "Saved", "count": len(payload.answers)}


@router.post("/{assessment_id}/complete")
def complete_assessment(assessment_id: uuid.UUID, request: Request,
                        db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    result = scoring.compute_and_persist(db, a)
    write_audit(db, user.username, "ASSESSMENT_COMPLETED",
                f"id={a.id} score={result['overall_score']}", client_ip(request))
    return result


@router.get("/{assessment_id}/risk")
def get_risk_summary(assessment_id: uuid.UUID, db: Session = Depends(get_db),
                     user: models.User = Depends(get_current_user)):
    """Risk assessment summary derived from the assessment responses."""
    a = _get_owned(db, assessment_id, user)
    return risk.build_risk_summary(db, a)


@router.delete("/{assessment_id}")
def delete_assessment(assessment_id: uuid.UUID, request: Request,
                      db: Session = Depends(get_db),
                      admin: models.User = Depends(require_admin)):
    """Admin-only: permanently delete an assessment and its child rows."""
    a = db.query(models.Assessment).filter(models.Assessment.id == assessment_id).first()
    if not a:
        raise HTTPException(status_code=404, detail="Assessment not found")
    org = a.organisation_name
    db.delete(a)  # cascades to answers / scores / actions
    db.commit()
    write_audit(db, admin.username, "ASSESSMENT_DELETED",
                f"org='{org}' id={assessment_id}", client_ip(request))
    return {"detail": "Assessment deleted"}


@router.get("/{assessment_id}/roadmap")
def get_roadmap(assessment_id: uuid.UUID, db: Session = Depends(get_db),
                user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    sugg = {s.id: s for s in db.query(models.RemediationSuggestion).all()}
    actions = db.query(models.RemediationAction).filter(
        models.RemediationAction.assessment_id == a.id).all()
    principles = {p.id: p for p in db.query(models.CafPrinciple).all()}
    items = []
    for act in actions:
        s = sugg.get(act.remediation_id)
        pr = principles.get(act.principle_id)
        items.append({
            "principle_id": act.principle_id,
            "principle_title": pr.title if pr else "",
            "objective_id": pr.objective_id if pr else "",
            "principle_score": float(act.principle_score),
            "title": s.title if s else "", "detail": s.detail if s else "",
            "priority": s.priority if s else 99, "effort": s.effort if s else "",
            "status": act.status, "external_ref": act.external_ref,
        })
    items.sort(key=lambda x: (x["priority"], x["principle_score"]))
    return items


@router.post("/{assessment_id}/report")
def export_report(assessment_id: uuid.UUID, meta: schemas.ReportMeta, request: Request,
                  db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    """Confirm org name + date, then generate the PDF report."""
    a = _get_owned(db, assessment_id, user)
    if a.status != "completed":
        raise HTTPException(status_code=400, detail="Complete the assessment before exporting")
    if meta.organisation_name:
        a.organisation_name = meta.organisation_name
    if meta.assessment_date:
        a.assessment_date = meta.assessment_date
    db.commit()
    path = pdf_report.generate_report(db, a)
    write_audit(db, user.username, "PDF_EXPORTED", f"id={a.id}", client_ip(request))
    return {"detail": "Report generated", "path": path}


@router.get("/{assessment_id}/report/download")
def download_report(assessment_id: uuid.UUID, db: Session = Depends(get_db),
                    user: models.User = Depends(get_current_user)):
    a = _get_owned(db, assessment_id, user)
    path = pdf_report.generate_report(db, a)
    return FileResponse(path, media_type="application/pdf",
                        filename=f"StrikeXi_Report_{a.organisation_name}.pdf")


@router.post("/{assessment_id}/push-itsm")
def push_to_itsm(assessment_id: uuid.UUID, request: Request, system: str = "log",
                 db: Session = Depends(get_db), user: models.User = Depends(get_current_user)):
    """Future-proofing endpoint: push roadmap items to Jira/ServiceNow (stubbed)."""
    a = _get_owned(db, assessment_id, user)
    results = itsm.push_actions(db, a.id, system=system)
    write_audit(db, user.username, "ITSM_PUSH", f"id={a.id} system={system} count={len(results)}",
                client_ip(request))
    return {"pushed": results}