from datetime import timedelta
from fastapi import APIRouter, Depends, HTTPException, status
from fastapi.security import OAuth2PasswordRequestForm
from app.core.config import settings
from app.db.mongodb import db
from app.schemas.user import UserCreate, UserResponse, Token
from app.services.auth import authenticate_user, create_access_token, get_password_hash
from app.models.role import get_role_level

router = APIRouter()

@router.post(
    "/register",
    response_model=UserResponse,
    status_code=status.HTTP_201_CREATED,
    summary="用户注册",
    description="创建基础账户（默认教育版、角色等级为1）。",
    responses={
        400: {"description": "用户名或邮箱已存在", "content": {"application/json": {"example": {"detail": "用户名已存在"}}}},
    },
)
async def register(user_data: UserCreate):
    """注册新用户"""
    # 检查用户名是否已存在
    existing_user = await db.db.users.find_one({"username": user_data.username})
    if existing_user:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="用户名已存在"
        )
    
    # 检查邮箱是否已存在
    existing_email = await db.db.users.find_one({"email": user_data.email})
    if existing_email:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="邮箱已被注册"
        )
    
    # 创建新用户
    hashed_password = get_password_hash(user_data.password)
    user = {
        "username": user_data.username,
        "email": user_data.email,
        "hashed_password": hashed_password,
        "role": "user",         # 默认为普通用户
        "role_level": 1,          # 默认为 1 级
        "edition": "edu",        # 默认为教育版，可在后续管理员界面修改
    }
    
    result = await db.db.users.insert_one(user)
    
    # 获取创建的用户
    created_user = await db.db.users.find_one({"_id": result.inserted_id})
    
    return {
        "id": str(created_user["_id"]),
        "username": created_user["username"],
        "email": created_user["email"],
        "role": created_user.get("role", "user"),
        "role_level": created_user.get("role_level", 1),
        "edition": created_user.get("edition", "edu"),
    }

@router.post(
    "/login",
    response_model=Token,
    summary="用户登录",
    description="使用表单登录（username/password），返回令牌与用户/绑定信息。",
    responses={
        401: {"description": "认证失败", "content": {"application/json": {"example": {"detail": "用户名或密码错误"}}}},
    },
)
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
    """用户登录"""
    user = await authenticate_user(form_data.username, form_data.password)
    if not user:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="用户名或密码错误",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    # 创建访问令牌（在载荷中加入用户的角色与版别信息）
    access_token_expires = timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
    access_token = create_access_token(
        data={
            "sub": str(user["_id"]),
            "role": user.get("role", "user"),
            "role_level": user.get("role_level", get_role_level(user.get("role"))),
            "edition": user.get("edition", "edu"),
            **({
                "person_id": str(b["person_id"]),
                "person_type": b.get("type"),
                "bound_primary": True,
            } if (b := await db.db.bindings.find_one({"account_id": user["_id"], "primary": True})) else {})
        },
        expires_delta=access_token_expires
    )
    # 登录响应中回传基础用户信息，前端免一次 /me 调用；后端仍应以服务端鉴权为准
    return {
        "access_token": access_token,
        "token_type": "bearer",
        "role": user.get("role", "user"),
        "role_level": user.get("role_level", get_role_level(user.get("role"))),
        "edition": user.get("edition", "edu"),
        **({
            "person_id": str(b["person_id"]),
            "person_type": b.get("type"),
            "bound_primary": True,
        } if b else {})
    }
