admin / Synapse-Cortex

import hashlib
import secrets
import uuid
from typing import Optional

from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.orm import Session

from .. import models, schemas
from ..audit import log_audit
from ..database import get_db
from ..deps import get_session_user
from ..security import hash_password

router = APIRouter()

ADMIN_ROLES = (models.UserRole.GLOBAL_ADMIN, models.UserRole.TENANT_ADMIN)
AUDIT_PAGE_SIZE = 25


def _require_admin_api(user: Optional[models.User]) -> None:
    if not user:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED)
    if user.role not in ADMIN_ROLES:
        raise HTTPException(status.HTTP_403_FORBIDDEN, detail="Admin privileges required")


def _assert_can_manage_role(actor: models.User, target_role: models.UserRole) -> None:
    """A tenant_admin may manage anyone except global_admin accounts.
    A global_admin may manage anyone."""
    if actor.role == models.UserRole.TENANT_ADMIN and target_role == models.UserRole.GLOBAL_ADMIN:
        raise HTTPException(status.HTTP_403_FORBIDDEN, detail="Only a global admin can manage global admin accounts")


# ---- Audit API --------------------------------------------------------------


@router.get("/api/v1/admin/audit", response_model=schemas.AuditLogListOut)
def list_audit_logs(
    page: int = 1,
    action: Optional[str] = None,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    _require_admin_api(user)

    page = max(page, 1)
    query = db.query(models.AuditLog).filter(models.AuditLog.tenant_id == user.tenant_id)
    if action:
        query = query.filter(models.AuditLog.action == action)

    total = query.count()
    pages = max((total + AUDIT_PAGE_SIZE - 1) // AUDIT_PAGE_SIZE, 1)
    logs = (
        query.order_by(models.AuditLog.created_at.desc())
        .offset((page - 1) * AUDIT_PAGE_SIZE)
        .limit(AUDIT_PAGE_SIZE)
        .all()
    )
    all_actions = sorted(
        {row[0] for row in db.query(models.AuditLog.action).filter(models.AuditLog.tenant_id == user.tenant_id).distinct()}
    )

    return schemas.AuditLogListOut(
        logs=logs, total=total, page=page, pages=pages, action_filter=action, all_actions=all_actions
    )


# ---- Users API -------------------------------------------------------------


@router.get("/api/v1/admin/users", response_model=list[schemas.UserOut])
def list_users(db: Session = Depends(get_db), user: Optional[models.User] = Depends(get_session_user)):
    _require_admin_api(user)
    return (
        db.query(models.User)
        .filter(models.User.tenant_id == user.tenant_id)
        .order_by(models.User.full_name)
        .all()
    )


@router.post("/api/v1/admin/users", response_model=schemas.UserOut, status_code=status.HTTP_201_CREATED)
def create_user(
    payload: schemas.UserCreate,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    _require_admin_api(user)
    _assert_can_manage_role(user, payload.role)

    existing = db.query(models.User).filter(models.User.email == payload.email.lower()).first()
    if existing:
        raise HTTPException(status.HTTP_409_CONFLICT, detail="A user with this email already exists")

    new_user = models.User(
        tenant_id=user.tenant_id,
        email=payload.email.lower(),
        full_name=payload.full_name,
        hashed_password=hash_password(payload.password),
        role=payload.role,
    )
    db.add(new_user)
    db.flush()
    log_audit(
        db,
        tenant_id=user.tenant_id,
        user_id=user.id,
        action="user_create",
        detail={"target_email": new_user.email, "role": new_user.role.value},
    )
    db.commit()
    db.refresh(new_user)
    return new_user


@router.patch("/api/v1/admin/users/{user_id}", response_model=schemas.UserOut)
def update_user(
    user_id: uuid.UUID,
    payload: schemas.UserUpdate,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    _require_admin_api(user)

    target = (
        db.query(models.User)
        .filter(models.User.id == user_id, models.User.tenant_id == user.tenant_id)
        .first()
    )
    if not target:
        raise HTTPException(status.HTTP_404_NOT_FOUND)

    _assert_can_manage_role(user, target.role)
    if payload.role is not None:
        _assert_can_manage_role(user, payload.role)

    changes: dict = {}
    if payload.full_name is not None and payload.full_name != target.full_name:
        changes["full_name"] = {"old": target.full_name, "new": payload.full_name}
        target.full_name = payload.full_name
    if payload.role is not None and payload.role != target.role:
        changes["role"] = {"old": target.role.value, "new": payload.role.value}
        target.role = payload.role
    if payload.is_active is not None and payload.is_active != target.is_active:
        changes["is_active"] = {"old": target.is_active, "new": payload.is_active}
        target.is_active = payload.is_active
    if payload.mfa_required is not None and payload.mfa_required != target.mfa_required:
        changes["mfa_required"] = {"old": target.mfa_required, "new": payload.mfa_required}
        target.mfa_required = payload.mfa_required

    if changes:
        log_audit(
            db,
            tenant_id=user.tenant_id,
            user_id=user.id,
            action="user_update",
            detail={"target_email": target.email, "changes": changes},
        )

    db.commit()
    db.refresh(target)
    return target


@router.delete("/api/v1/admin/users/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
def delete_user(
    user_id: uuid.UUID,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    _require_admin_api(user)

    if user_id == user.id:
        raise HTTPException(status.HTTP_400_BAD_REQUEST, detail="You cannot delete your own account")

    target = (
        db.query(models.User)
        .filter(models.User.id == user_id, models.User.tenant_id == user.tenant_id)
        .first()
    )
    if not target:
        raise HTTPException(status.HTTP_404_NOT_FOUND)

    _assert_can_manage_role(user, target.role)

    log_audit(
        db,
        tenant_id=user.tenant_id,
        user_id=user.id,
        action="user_delete",
        detail={"target_email": target.email},
    )
    db.delete(target)
    db.commit()
    return None


# ---- Integrations (NetscanXi ingest key) API -------------------------------
# One active key per tenant, hash-only storage - mirrors NetscanXi's own
# outbound-key pattern exactly (see NetscanXiVersion13/app/server.py's
# _resolve_outbound_key / api_outbound_key_generate).

INGEST_KEY_PREFIX = "cortex_in_"


@router.get("/api/v1/admin/integrations")
def get_integration_status(db: Session = Depends(get_db), user: Optional[models.User] = Depends(get_session_user)):
    _require_admin_api(user)
    key_row = db.query(models.IntegrationKey).filter(models.IntegrationKey.tenant_id == user.tenant_id).first()
    return {
        "key_set": key_row is not None,
        "enabled": key_row.enabled if key_row else False,
        "created_at": key_row.created_at if key_row else None,
        "last_used_at": key_row.last_used_at if key_row else None,
    }


@router.post("/api/v1/admin/integrations/key", status_code=status.HTTP_201_CREATED)
def generate_integration_key(db: Session = Depends(get_db), user: Optional[models.User] = Depends(get_session_user)):
    """(Re)generate the ingest key. Returns the plaintext exactly once;
    rotating immediately invalidates the previous key."""
    _require_admin_api(user)

    raw_key = INGEST_KEY_PREFIX + secrets.token_hex(24)
    key_hash = hashlib.sha256(raw_key.encode("utf-8")).hexdigest()

    key_row = db.query(models.IntegrationKey).filter(models.IntegrationKey.tenant_id == user.tenant_id).first()
    if key_row:
        key_row.key_hash = key_hash
        key_row.enabled = True
        key_row.last_used_at = None
        key_row.created_by_id = user.id
    else:
        key_row = models.IntegrationKey(
            tenant_id=user.tenant_id, key_hash=key_hash, enabled=True, created_by_id=user.id
        )
        db.add(key_row)

    log_audit(db, tenant_id=user.tenant_id, user_id=user.id, action="api_key_generated")
    db.commit()
    return {"api_key": raw_key, "enabled": True}


@router.post("/api/v1/admin/integrations/toggle")
def toggle_integration_key(
    enabled: bool,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    _require_admin_api(user)
    key_row = db.query(models.IntegrationKey).filter(models.IntegrationKey.tenant_id == user.tenant_id).first()
    if not key_row:
        raise HTTPException(status.HTTP_404_NOT_FOUND, detail="No API key has been generated yet")
    key_row.enabled = enabled
    db.commit()
    return {"enabled": key_row.enabled}


@router.delete("/api/v1/admin/integrations/key")
def revoke_integration_key(db: Session = Depends(get_db), user: Optional[models.User] = Depends(get_session_user)):
    _require_admin_api(user)
    key_row = db.query(models.IntegrationKey).filter(models.IntegrationKey.tenant_id == user.tenant_id).first()
    if key_row:
        db.delete(key_row)
        log_audit(db, tenant_id=user.tenant_id, user_id=user.id, action="api_key_revoked")
        db.commit()
    return {"key_set": False, "enabled": False}


# ---- Asset Types API --------------------------------------------------------


@router.get("/api/v1/admin/asset-types", response_model=list[schemas.AssetTypeOptionOut])
def list_asset_types(db: Session = Depends(get_db), user: Optional[models.User] = Depends(get_session_user)):
    _require_admin_api(user)
    return (
        db.query(models.AssetTypeOption)
        .filter(models.AssetTypeOption.tenant_id == user.tenant_id)
        .order_by(models.AssetTypeOption.name)
        .all()
    )


@router.post("/api/v1/admin/asset-types", response_model=schemas.AssetTypeOptionOut, status_code=status.HTTP_201_CREATED)
def create_asset_type(
    payload: schemas.AssetTypeOptionCreate,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    _require_admin_api(user)

    name = payload.name.strip()
    existing = (
        db.query(models.AssetTypeOption)
        .filter(models.AssetTypeOption.tenant_id == user.tenant_id, models.AssetTypeOption.name == name)
        .first()
    )
    if existing:
        raise HTTPException(status.HTTP_409_CONFLICT, detail="An asset type with this name already exists")

    asset_type = models.AssetTypeOption(tenant_id=user.tenant_id, name=name)
    db.add(asset_type)
    db.flush()
    log_audit(db, tenant_id=user.tenant_id, user_id=user.id, action="asset_type_create", detail={"name": name})
    db.commit()
    db.refresh(asset_type)
    return asset_type


@router.patch("/api/v1/admin/asset-types/{type_id}", response_model=schemas.AssetTypeOptionOut)
def update_asset_type(
    type_id: uuid.UUID,
    payload: schemas.AssetTypeOptionUpdate,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    _require_admin_api(user)

    target = (
        db.query(models.AssetTypeOption)
        .filter(models.AssetTypeOption.id == type_id, models.AssetTypeOption.tenant_id == user.tenant_id)
        .first()
    )
    if not target:
        raise HTTPException(status.HTTP_404_NOT_FOUND)

    name = payload.name.strip()
    existing = (
        db.query(models.AssetTypeOption)
        .filter(
            models.AssetTypeOption.tenant_id == user.tenant_id,
            models.AssetTypeOption.name == name,
            models.AssetTypeOption.id != type_id,
        )
        .first()
    )
    if existing:
        raise HTTPException(status.HTTP_409_CONFLICT, detail="An asset type with this name already exists")

    if name != target.name:
        log_audit(
            db,
            tenant_id=user.tenant_id,
            user_id=user.id,
            action="asset_type_update",
            detail={"old_name": target.name, "new_name": name},
        )
        target.name = name

    db.commit()
    db.refresh(target)
    return target


@router.delete("/api/v1/admin/asset-types/{type_id}", status_code=status.HTTP_204_NO_CONTENT)
def delete_asset_type(
    type_id: uuid.UUID,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    _require_admin_api(user)

    target = (
        db.query(models.AssetTypeOption)
        .filter(models.AssetTypeOption.id == type_id, models.AssetTypeOption.tenant_id == user.tenant_id)
        .first()
    )
    if not target:
        raise HTTPException(status.HTTP_404_NOT_FOUND)

    in_use = db.query(models.Asset).filter(models.Asset.asset_type_id == type_id).first()
    if in_use:
        raise HTTPException(
            status.HTTP_409_CONFLICT,
            detail="This asset type is in use by one or more assets and cannot be deleted",
        )

    log_audit(db, tenant_id=user.tenant_id, user_id=user.id, action="asset_type_delete", detail={"name": target.name})
    db.delete(target)
    db.commit()
    return None