"""认证路由：登录签发 JWT + 当前用户信息（get_current_user 依赖注入示例）。"""
from fastapi import APIRouter, Depends
from sqlalchemy.ext.asyncio import AsyncSession

from api.deps import get_current_user
from config.deps import get_db
from schemas.auth import LoginReq
from model.sys_user import SysUser
from repositories.sys_user import SysUserRepo
from service.auth import create_token, verify_password
from utils.exceptions import ForbiddenError, ParamError
from utils.response import success

router = APIRouter()


def user_payload(u: SysUser) -> dict:
    return {
        "id": u.id,
        "username": u.username,
        "user_type": u.user_type,
        "employee_role": u.employee_role,
        "customer_level": u.customer_level,
        "status": u.status,
    }


@router.post("/auth/login")
async def login(body: LoginReq, db: AsyncSession = Depends(get_db)):
    user = await SysUserRepo(db).get_by_username(body.username)
    if user is None or not verify_password(body.password, user.password_hash):
        raise ParamError("用户名或密码错误")
    if user.status != "正常":
        raise ForbiddenError("账号状态异常，无法登录")
    return success({"token": create_token(user.id), "user": user_payload(user)})


@router.get("/auth/me")
async def me(user: SysUser = Depends(get_current_user)):
    """受保护示例路由：任意接口加 Depends(get_current_user) 即获得当前用户。"""
    return success({"user": user_payload(user)})