"""User management endpoints."""
from fastapi import APIRouter, Depends, HTTPException
from sqlalchemy.orm import Session
from typing import List
from app.database import get_db
from app.schemas.user import UserCreate, UserUpdate, UserResponse
from app.schemas.common import SuccessResponse
from sqlalchemy import select
from app.models.user import User
from app.api.deps import get_current_user, require_roles, get_tenant_id
from app.core.permissions import Role
from app.core.security import hash_password

router = APIRouter(prefix="/users")


@router.get("", response_model=List[UserResponse])
def list_users(
    skip: int = 0, limit: int = 100,
    user: User = Depends(require_roles(Role.SUPER_ADMIN, Role.TENANT_ADMIN)),
    db: Session = Depends(get_db),
):
    q = db.query(User)
    if user.role != Role.SUPER_ADMIN.value:
        q = q.filter(User.tenant_id == user.tenant_id)
    return q.offset(skip).limit(limit).all()


@router.post("", response_model=UserResponse)
def create_user(
    req: UserCreate,
    user: User = Depends(require_roles(Role.SUPER_ADMIN, Role.TENANT_ADMIN)),
    db: Session = Depends(get_db),
):
    existing = db.query(User).filter(User.email == req.email).first()
    if existing:
        raise HTTPException(status_code=409, detail="Email already exists")

    new_user = User(
        email=req.email,
        username=req.username,
        hashed_password=hash_password(req.password),
        role=req.role,
        user_type=req.user_type,
        phone=req.phone,
        tenant_id=user.tenant_id,  # same tenant as creator
    )
    db.add(new_user)
    db.commit()
    db.refresh(new_user)
    return new_user


@router.get("/{user_id}", response_model=UserResponse)
def get_user(
    user_id: int,
    user: User = Depends(get_current_user),
    db: Session = Depends(get_db),
):
    target = db.query(User).filter(User.id == user_id).first()
    if not target:
        raise HTTPException(status_code=404, detail="User not found")
    if user.role != Role.SUPER_ADMIN.value and target.tenant_id != user.tenant_id:
        raise HTTPException(status_code=403, detail="Cannot access other tenants")
    return target


@router.put("/{user_id}", response_model=UserResponse)
def update_user(
    user_id: int,
    req: UserUpdate,
    user: User = Depends(require_roles(Role.SUPER_ADMIN, Role.TENANT_ADMIN)),
    db: Session = Depends(get_db),
):
    target = db.query(User).filter(User.id == user_id).first()
    if not target:
        raise HTTPException(status_code=404, detail="User not found")
    if user.role != Role.SUPER_ADMIN.value and target.tenant_id != user.tenant_id:
        raise HTTPException(status_code=403, detail="Cannot access other tenants")
    for field, value in req.model_dump(exclude_unset=True).items():
        setattr(target, field, value)
    db.commit()
    db.refresh(target)
    return target


@router.delete("/{user_id}", response_model=SuccessResponse)
def delete_user(
    user_id: int,
    user: User = Depends(require_roles(Role.SUPER_ADMIN, Role.TENANT_ADMIN)),
    db: Session = Depends(get_db),
):
    target = db.query(User).filter(User.id == user_id).first()
    if not target:
        raise HTTPException(status_code=404, detail="User not found")
    if target.tenant_id != user.tenant_id and user.role != Role.SUPER_ADMIN.value:
        raise HTTPException(status_code=403, detail="Cannot access other tenants")
    db.delete(target)
    db.commit()
    return SuccessResponse(message=f"User #{user_id} deleted")