# api/auth.py
# 认证模块：登录（签发 JWT）、创建用户（仅管理员）、获取当前用户信息
from fastapi import APIRouter, Depends, HTTPException
from sqlalchemy.orm import Session

from core.security import verify_password, create_access_token
from core.deps import get_current_user, require_roles
from dao.users_dao import UserDAO
from database import get_db
from model.user import User
from scheme.users import UserAdd, UserLogin, UserResponse, TokenResponse

router = APIRouter()


# ---------- 登录 ----------
@router.post("/login", response_model=TokenResponse, summary="登录获取 JWT token")
async def login(body: UserLogin, db: Session = Depends(get_db)):
    user = UserDAO.get_by_username(db, body.username)
    # 用户不存在 / 已被软删除 / 密码错误，统一返回 401（避免暴露用户是否存在）
    if (user is None) or user.is_deleted == 1 or not verify_password(body.password, user.password_hash):
        raise HTTPException(status_code=401, detail="用户名或密码错误")
    token = create_access_token(user.user_id, user.role)
    return TokenResponse(
        access_token=token,
        user=UserResponse.model_validate(user),
    )


# ---------- 创建用户（仅管理员） ----------
@router.post("/register", response_model=UserResponse, summary="创建用户（仅管理员）")
async def register(
    body: UserAdd,
    db: Session = Depends(get_db),
    current_user: User = Depends(require_roles("admin")),
):
    existing = UserDAO.get_by_username(db, body.username)
    if existing:
        raise HTTPException(status_code=409, detail="用户名已存在")
    # 绑定业务身份的合法性校验
    if body.role == "student" and body.stu_id is None:
        raise HTTPException(status_code=400, detail="student 角色必须提供 stu_id")
    if body.role == "teacher" and body.teacher_id is None:
        raise HTTPException(status_code=400, detail="teacher 角色必须提供 teacher_id")
    user = UserDAO.add_user(db, body)
    return user


# ---------- 获取当前登录用户 ----------
@router.get("/me", response_model=UserResponse, summary="获取当前登录用户信息")
async def me(current_user: User = Depends(get_current_user)):
    return current_user