admin / Synapse-Cortex

import uuid
from datetime import datetime, timezone
from typing import Optional

from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.orm import Session

from .. import models, schemas
from ..audit import log_audit
from ..database import get_db
from ..deps import get_session_user
from ..queries import (
    QUEUE_FILTERS,
    TICKET_SORTS,
    apply_queue_filter,
    apply_sla,
    apply_ticket_search,
    apply_ticket_sort,
    next_ticket_number,
    tenant_tickets,
)

router = APIRouter(prefix="/api/v1/tickets", tags=["tickets"])


@router.get("", response_model=list[schemas.TicketOut])
def list_tickets(
    status_filter: Optional[models.TicketStatus] = None,
    filter: Optional[str] = None,
    q: Optional[str] = None,
    sort: Optional[str] = None,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    if not user:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED)

    query = tenant_tickets(db, user.tenant_id)
    if status_filter:
        query = query.filter(models.Ticket.status == status_filter)
    if filter in QUEUE_FILTERS:
        query = apply_queue_filter(query, filter)

    search_text = (q or "").strip()
    if search_text:
        query = apply_ticket_search(query, search_text)

    active_sort = sort if sort in TICKET_SORTS else "newest"
    query, python_sort_key = apply_ticket_sort(query, active_sort)

    tickets = query.all()
    if python_sort_key:
        tickets = sorted(tickets, key=python_sort_key)
    return tickets


@router.get("/{ticket_id}", response_model=schemas.TicketOut)
def get_ticket(
    ticket_id: uuid.UUID,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    if not user:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED)
    ticket = (
        db.query(models.Ticket)
        .filter(models.Ticket.id == ticket_id, models.Ticket.tenant_id == user.tenant_id)
        .first()
    )
    if not ticket:
        raise HTTPException(status.HTTP_404_NOT_FOUND)
    return ticket


@router.post("", response_model=schemas.TicketOut, status_code=status.HTTP_201_CREATED)
def create_ticket(
    payload: schemas.TicketCreate,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    if not user:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED)

    if payload.asset_id:
        asset = (
            db.query(models.Asset)
            .filter(models.Asset.id == payload.asset_id, models.Asset.tenant_id == user.tenant_id)
            .first()
        )
        if not asset:
            raise HTTPException(status.HTTP_404_NOT_FOUND, detail="Asset not found in this tenant")

    if payload.assigned_to_id:
        assignee = (
            db.query(models.User)
            .filter(models.User.id == payload.assigned_to_id, models.User.tenant_id == user.tenant_id)
            .first()
        )
        if not assignee:
            raise HTTPException(status.HTTP_404_NOT_FOUND, detail="Assignee not found in this tenant")

    ticket = models.Ticket(
        tenant_id=user.tenant_id,
        ticket_number=next_ticket_number(db, user.tenant_id),
        title=payload.title,
        description=payload.description,
        ticket_type=payload.ticket_type,
        priority=payload.priority,
        requester_id=user.id,
        assigned_to_id=payload.assigned_to_id,
        asset_id=payload.asset_id,
    )
    db.add(ticket)
    db.flush()
    apply_sla(db, ticket)
    log_audit(
        db,
        tenant_id=user.tenant_id,
        user_id=user.id,
        action="ticket_create",
        detail={"ticket_number": ticket.ticket_number, "title": ticket.title},
    )
    db.commit()
    db.refresh(ticket)
    return ticket


@router.patch("/{ticket_id}", response_model=schemas.TicketOut)
def update_ticket(
    ticket_id: uuid.UUID,
    payload: schemas.TicketUpdate,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    if not user:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED)

    ticket = (
        db.query(models.Ticket)
        .filter(models.Ticket.id == ticket_id, models.Ticket.tenant_id == user.tenant_id)
        .first()
    )
    if not ticket:
        raise HTTPException(status.HTTP_404_NOT_FOUND)

    changes: dict = {}

    if payload.title is not None and payload.title != ticket.title:
        changes["title"] = {"old": ticket.title, "new": payload.title}
        ticket.title = payload.title

    if payload.description is not None and payload.description != ticket.description:
        changes["description"] = {"old": ticket.description, "new": payload.description}
        ticket.description = payload.description

    if payload.assigned_to_id is not None:
        assignee = (
            db.query(models.User)
            .filter(models.User.id == payload.assigned_to_id, models.User.tenant_id == user.tenant_id)
            .first()
        )
        if not assignee:
            raise HTTPException(status.HTTP_404_NOT_FOUND, detail="Assignee not found in this tenant")
        if payload.assigned_to_id != ticket.assigned_to_id:
            changes["assigned_to_id"] = {"old": str(ticket.assigned_to_id), "new": str(payload.assigned_to_id)}
            ticket.assigned_to_id = payload.assigned_to_id

    if payload.priority is not None and payload.priority != ticket.priority:
        changes["priority"] = {"old": ticket.priority.value, "new": payload.priority.value}
        ticket.priority = payload.priority
        apply_sla(db, ticket)

    if payload.status is not None and payload.status != ticket.status:
        changes["status"] = {"old": ticket.status.value, "new": payload.status.value}
        ticket.status = payload.status
        if payload.status in (models.TicketStatus.RESOLVED, models.TicketStatus.CLOSED):
            ticket.resolved_at = datetime.now(timezone.utc)

    if payload.credential_ref_id is not None and payload.credential_ref_id != ticket.credential_ref_id:
        credential = (
            db.query(models.CredentialVaultEntry)
            .filter(
                models.CredentialVaultEntry.id == payload.credential_ref_id,
                models.CredentialVaultEntry.tenant_id == user.tenant_id,
            )
            .first()
        )
        if not credential:
            raise HTTPException(status.HTTP_404_NOT_FOUND, detail="Credential not found in this tenant")
        changes["credential_ref_id"] = {"old": str(ticket.credential_ref_id), "new": str(payload.credential_ref_id)}
        ticket.credential_ref_id = payload.credential_ref_id

    if changes:
        log_audit(
            db,
            tenant_id=user.tenant_id,
            user_id=user.id,
            action="ticket_update",
            detail={"ticket_number": ticket.ticket_number, "changes": changes},
        )

    db.commit()
    db.refresh(ticket)
    return ticket


ADMIN_ROLES = (models.UserRole.GLOBAL_ADMIN, models.UserRole.TENANT_ADMIN)


@router.post("/bulk-delete")
def bulk_delete_tickets(
    payload: schemas.TicketBulkDeleteRequest,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    if not user:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED)
    if user.role not in ADMIN_ROLES:
        raise HTTPException(status.HTTP_403_FORBIDDEN, detail="Admin privileges required")

    tickets = (
        db.query(models.Ticket)
        .filter(models.Ticket.tenant_id == user.tenant_id, models.Ticket.id.in_(payload.ticket_ids))
        .all()
    )
    if not tickets:
        raise HTTPException(status.HTTP_404_NOT_FOUND, detail="No matching tickets found")

    ticket_numbers = [t.ticket_number for t in tickets]
    for ticket in tickets:
        db.delete(ticket)

    log_audit(
        db,
        tenant_id=user.tenant_id,
        user_id=user.id,
        action="ticket_bulk_delete",
        detail={"count": len(tickets), "ticket_numbers": ticket_numbers},
    )
    db.commit()
    return {"deleted": len(tickets)}


@router.delete("/{ticket_id}", status_code=status.HTTP_204_NO_CONTENT)
def delete_ticket(
    ticket_id: uuid.UUID,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    if not user:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED)
    if user.role not in ADMIN_ROLES:
        raise HTTPException(status.HTTP_403_FORBIDDEN, detail="Admin privileges required")

    ticket = (
        db.query(models.Ticket)
        .filter(models.Ticket.id == ticket_id, models.Ticket.tenant_id == user.tenant_id)
        .first()
    )
    if not ticket:
        raise HTTPException(status.HTTP_404_NOT_FOUND)

    log_audit(
        db,
        tenant_id=user.tenant_id,
        user_id=user.id,
        action="ticket_delete",
        detail={"ticket_number": ticket.ticket_number, "title": ticket.title},
    )
    db.delete(ticket)
    db.commit()
    return None


@router.get("/{ticket_id}/actions", response_model=list[schemas.TicketActionOut])
def list_ticket_actions(
    ticket_id: uuid.UUID,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    if not user:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED)

    ticket = (
        db.query(models.Ticket)
        .filter(models.Ticket.id == ticket_id, models.Ticket.tenant_id == user.tenant_id)
        .first()
    )
    if not ticket:
        raise HTTPException(status.HTTP_404_NOT_FOUND)

    return (
        db.query(models.TicketAction)
        .filter(models.TicketAction.ticket_id == ticket_id, models.TicketAction.tenant_id == user.tenant_id)
        .order_by(models.TicketAction.created_at.desc())
        .all()
    )


@router.post("/{ticket_id}/actions", response_model=schemas.TicketActionOut, status_code=status.HTTP_201_CREATED)
def create_ticket_action(
    ticket_id: uuid.UUID,
    payload: schemas.TicketActionCreate,
    db: Session = Depends(get_db),
    user: Optional[models.User] = Depends(get_session_user),
):
    if not user:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED)

    ticket = (
        db.query(models.Ticket)
        .filter(models.Ticket.id == ticket_id, models.Ticket.tenant_id == user.tenant_id)
        .first()
    )
    if not ticket:
        raise HTTPException(status.HTTP_404_NOT_FOUND)

    action = models.TicketAction(
        tenant_id=user.tenant_id,
        ticket_id=ticket_id,
        user_id=user.id,
        body=payload.body,
    )
    db.add(action)
    log_audit(
        db,
        tenant_id=user.tenant_id,
        user_id=user.id,
        action="ticket_action_add",
        detail={"ticket_number": ticket.ticket_number},
    )
    db.commit()
    db.refresh(action)
    return action