"""
Authentication Router

This module provides the authentication router for the MTG Online application.
It handles user authentication, registration, and session management through
JWT (JSON Web Token) based authentication.

The router provides the following endpoints:
    - POST /login: Authenticate user credentials and return JWT tokens
    - POST /refresh: Refresh an expired access token using a refresh token
    - POST /register: Register a new user account
    - GET /me: Retrieve the current authenticated user's profile

All endpoints use async SQLAlchemy for database operations and FastAPI
dependencies for database session management.
"""

from datetime import datetime, timezone
from typing import Optional

from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.database import get_db
from app.core.security import (
    create_access_token,
    create_refresh_token,
    decode_token,
    hash_password,
    verify_password,
)
from app.models.models import User
from app.schemas.schemas import (
    LoginRequest,
    LoginResponse,
    RefreshTokenRequest,
    TokenResponse,
    UserCreate,
    UserResponse,
)

router = APIRouter()


@router.post("/login", response_model=LoginResponse)
async def login(
    request: LoginRequest,
    db: AsyncSession = Depends(get_db),
) -> LoginResponse:
    """Authenticate user and return JWT tokens.

    Validates the provided username and password against the database.
    Checks if the account is active and not banned before issuing tokens.
    Updates the user's last login timestamp on successful authentication.

    Args:
        request: The login request containing username and password.
        db: The async database session.

    Returns:
        LoginResponse containing access_token, refresh_token, and user data.

    Raises:
        HTTPException 401: Invalid username or password.
        HTTPException 403: Account is disabled or currently banned.
    """
    # Find user by username
    stmt = select(User).where(User.username == request.username)
    result = await db.execute(stmt)
    user = result.scalar_one_or_none()

    if not user or not verify_password(request.password, user.password_hash):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid username or password",
        )

    if not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Account is disabled",
        )

    if user.is_banned and user.ban_ends and user.ban_ends > datetime.now():
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Account is banned",
        )

    # Update last login
    user.last_login = datetime.now(timezone.utc)
    await db.flush()

    # Generate tokens
    access_token = create_access_token(str(user.id), user.privlevel or "User")
    refresh_token = create_refresh_token(str(user.id), user.privlevel or "User")

    return LoginResponse(
        access_token=access_token,
        refresh_token=refresh_token,
        user=UserResponse.model_validate(user).model_dump(),
    )


@router.post("/refresh", response_model=TokenResponse)
async def refresh_token(
    request: RefreshTokenRequest,
    db: AsyncSession = Depends(get_db),
) -> TokenResponse:
    """Refresh access token using refresh token.

    Validates the provided refresh token and issues a new access token
    if the token is valid and the associated user account is still active.

    Args:
        request: The refresh token request.
        db: The async database session.

    Returns:
        TokenResponse containing a new access_token.

    Raises:
        HTTPException 401: Invalid refresh token or inactive user account.
    """
    payload = decode_token(request.refresh_token)

    if not payload or payload.get("type") != "refresh":
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid refresh token",
        )

    # Verify user still exists and is active
    user_id = payload["sub"]
    stmt = select(User).where(User.id == int(user_id))
    result = await db.execute(stmt)
    user = result.scalar_one_or_none()

    if not user or not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="User account is invalid",
        )

    # Generate new access token
    access_token = create_access_token(str(user.id), user.privlevel or "User")

    return TokenResponse(access_token=access_token)


@router.post("/register", response_model=UserResponse)
async def register(
    request: UserCreate,
    db: AsyncSession = Depends(get_db),
) -> UserResponse:
    """Register a new user account.

    Creates a new user in the database after checking for duplicate
    username and email addresses. The password is hashed before storage.

    Args:
        request: The user registration data.
        db: The async database session.

    Returns:
        UserResponse containing the newly created user data.

    Raises:
        HTTPException 409: Username or email already exists.
    """
    # Check if username exists
    stmt = select(User).where(User.username == request.username)
    result = await db.execute(stmt)
    if result.scalar_one_or_none():
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail="Username already exists",
        )

    # Check if email exists (if provided)
    if request.email:
        stmt = select(User).where(User.email == request.email)
        result = await db.execute(stmt)
        if result.scalar_one_or_none():
            raise HTTPException(
                status_code=status.HTTP_409_CONFLICT,
                detail="Email already registered",
            )

    # Create new user
    new_user = User(
        username=request.username,
        password_hash=hash_password(request.password),
        salt="random_salt",  # In production, generate random salt
        email=request.email,
        country=request.country,
        real_name=request.real_name,
    )
    db.add(new_user)
    await db.flush()

    return UserResponse.model_validate(new_user)


@router.get("/me", response_model=UserResponse)
async def get_current_user(
    token: str,
    db: AsyncSession = Depends(get_db),
) -> UserResponse:
    """Get current authenticated user.

    Decodes the provided JWT access token and retrieves the associated
    user profile from the database.

    Args:
        token: The JWT access token.
        db: The async database session.

    Returns:
        UserResponse containing the current user's profile data.

    Raises:
        HTTPException 401: Invalid or expired token.
        HTTPException 404: User not found in database.
    """
    payload = decode_token(token)

    if not payload or payload.get("type") != "access":
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid token",
        )

    user_id = payload["sub"]
    stmt = select(User).where(User.id == int(user_id))
    result = await db.execute(stmt)
    user = result.scalar_one_or_none()

    if not user:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="User not found",
        )

    return UserResponse.model_validate(user)