"""开发期 Mock 登录：签发 JWT（与模块 auth_service 同一 issuer/audience）。"""

from __future__ import annotations

from fastapi import APIRouter, Request

from app.config.settings import settings
from app.gateway.jwt_service import infer_roles, permissions_for_roles
from app.model.schemas import LoginRequest, LoginResponseData
from app.service.auth_service import issue_dev_token
from app.utils.response import ok

router = APIRouter(prefix="/api/auth", tags=["auth"])


@router.post("/login")
def login(body: LoginRequest, request: Request):
    roles = infer_roles(body.actor_id, body.token_type, body.roles)
    if not roles:
        from app.utils.exceptions import UnauthorizedError

        raise UnauthorizedError("未知账号，无法签发 token", error_code="AUTH_401_UNKNOWN_ACTOR")

    permissions = permissions_for_roles(roles)
    customer_id = body.actor_id if body.token_type == "customer" else None
    advisor_id = body.actor_id if body.token_type == "staff" and "advisor" in roles else None
    token = issue_dev_token(
        sub=body.actor_id,
        roles=roles,
        token_type=body.token_type,
        exp_minutes=settings.jwt_dev_expire_hours * 60,
        tenant_id="TENANT-001",
        customer_id=customer_id,
        advisor_id=advisor_id,
        permissions=permissions,
    )
    trace_id = getattr(request.state, "trace_id", "unknown")
    data = LoginResponseData(
        access_token=token,
        expires_in=settings.jwt_dev_expire_hours * 3600,
        sub=body.actor_id,
        roles=roles,
    )
    return ok(data.model_dump(), trace_id, message="login ok")