"""API 依赖：鉴权上下文（架构 §5.7 · 归属校验统一在此层）。

AuthContext 模型在 A4 冻结（开发计划 v1.1）；B6 落地 `get_auth_context()`：
dev（app_env=development）从 `X-Debug-Role` / `X-Debug-Actor` 请求头构造
（customer 角色 customer_id=actor_id），非 dev 请求时拒绝（启动期全局检查
归 B7 lifespan：非 dev 且 AUTH_FACTORY_IS_DEBUG 拒绝启动，挂账⑤）；
T-01 就绪后替换工厂内部为 JWT 解析并置 AUTH_FACTORY_IS_DEBUG=False，
签名与调用方零改动。

归属断言 `assert_customer_access` 对齐 JWT 手册 §6.1/§6.2 与 PRD G-01：
customer 仅本人（AUTH_403_NOT_OWNER）、advisor 经 customer_advisor_rel
（AUTH_403_NOT_ASSIGNED）、risk_officer 全量；越权 403 + audit 留痕（A-9）。
所有 403/401 一律经 `deny`/`unauthenticated` 审计（手册 P-05 全局铁律，
B6 评审 P1-1）；响应体为统一错误结构（utils/response，手册 §10，B7 挂账④）；
多角色按 fail-closed 口径固化（customer 分支优先，命中 deny 即拒，不再并集
放宽——评审 P3-1②，T-01 引入 token_type 后收紧）。
"""

from __future__ import annotations

from fastapi import Request
from pydantic import BaseModel, Field

from app.config.settings import settings
from app.repository.core_ro import CoreReadOnlyRepository
from app.repository.risk_repository import RiskRepository
from app.utils.exceptions import ApiError, PermissionDenied
from app.utils.trace import current_trace, new_trace

STAFF_FULL_ACCESS_ROLES = ("risk_officer",)
DEBUG_ROLE_HEADER = "X-Debug-Role"
DEBUG_ACTOR_HEADER = "X-Debug-Actor"

# B7 挂账⑤：debug 头工厂是 T-01 过渡实现；main.lifespan 据此在非 dev 环境
# 拒绝启动。T-01 接入 JWT 工厂后置 False（或改为按注册工厂判定）。
AUTH_FACTORY_IS_DEBUG = True


class AuthContext(BaseModel):
    """统一鉴权上下文（全部 API 依赖层的产出；service 层签名接收此类型）。"""

    actor_id: str = Field(..., description="操作者 ID：staff_id 或 customer_id")
    roles: list[str] = Field(default_factory=list, description="角色集合，如 ['risk_officer','risk_demo']")
    customer_id: str | None = Field(None, description="customer 角色时 = 本人 customer_id；其余为空")

    def has_role(self, *roles: str) -> bool:
        return any(r in self.roles for r in roles)

    def is_customer(self) -> bool:
        return "customer" in self.roles


def _authz_audit(
    risk_repo: RiskRepository,
    auth: AuthContext | None,
    customer_id: str | None,
    code: str,
    agent_type: str = "risk",
) -> None:
    """鉴权失败审计（event_type='authz'；手册 P-05，B6 评审 P1-1）。

    agent_type 按路由归属传入（网关路由传 'platform'，复审 P3：与放行审计
    同口径，避免按模块检索审计时漏网关越权事件）。
    """
    risk_repo.insert_audit_log(
        {
            "trace_id": current_trace() or new_trace(),
            "event_type": "authz",
            "agent_type": agent_type,
            "actor_id": auth.actor_id if auth else "anonymous",
            "customer_id": customer_id,
            "rule_id": None,
            "input_summary": {"roles": auth.roles if auth else [], "code": code},
            "decision": "forbidden",
            "risk_score": None,
            "handler_id": None,
            "handler_result": None,
            "handler_comment": None,
        }
    )


def deny(
    auth: AuthContext,
    code: str,
    risk_repo: RiskRepository,
    customer_id: str | None = None,
    message: str | None = None,
    agent_type: str = "risk",
) -> None:
    """越权出口：审计 + 403（全部 403 必经此函数，保证留痕与错误码）。"""
    _authz_audit(risk_repo, auth, customer_id, code, agent_type)
    raise PermissionDenied(code, message or f"forbidden: {code}")


def get_auth_context(request: Request) -> AuthContext:
    """鉴权工厂（B6）：dev 读 debug 头，非 dev 拒绝；T-01 后替换内部为 JWT 解析。"""
    if settings.app_env != "development":
        raise RuntimeError(
            f"debug auth disabled outside development (app_env={settings.app_env})"
        )
    roles = [r.strip() for r in request.headers.get(DEBUG_ROLE_HEADER, "").split(",") if r.strip()]
    actor_id = request.headers.get(DEBUG_ACTOR_HEADER, "").strip()
    if not roles or not actor_id:
        # 401 也留痕（P1-1）；debug 通道仅 dev，生产等价流量由 JWT 中间件拒绝
        repo = RiskRepository()
        repo.insert_audit_log(
            {
                "trace_id": current_trace() or new_trace(),
                "event_type": "authz",
                "agent_type": "risk",
                "actor_id": actor_id or "anonymous",
                "customer_id": None,
                "rule_id": None,
                "input_summary": {"roles": roles, "code": "AUTH_401_MISSING_DEBUG_HEADERS"},
                "decision": "unauthenticated",
                "risk_score": None,
                "handler_id": None,
                "handler_result": None,
                "handler_comment": None,
            }
        )
        raise ApiError(
            401, "AUTH_401_MISSING_DEBUG_HEADERS", "missing X-Debug-Role/X-Debug-Actor headers"
        )
    return AuthContext(
        actor_id=actor_id,
        roles=roles,
        customer_id=actor_id if "customer" in roles else None,
    )


def assert_customer_access(
    auth: AuthContext,
    customer_id: str,
    core_ro: CoreReadOnlyRepository,
    risk_repo: RiskRepository,
) -> None:
    """G-01 归属断言（customer/advisor/risk_officer；其他角色一律拒绝）。

    customer 仅本人；advisor 需 customer_advisor_rel active；risk_officer 全量。
    compliance 不在客户业务数据访问白名单（仅审计类读，JWT 手册 §5.3）。
    core_ro/risk_repo 必传（评审 P3-3/P3-4：审计与归属查询不得静默降级）。
    多角色 fail-closed：customer 分支 deny 即终止（P3-1② 固化口径）。
    """
    if auth.has_role(*STAFF_FULL_ACCESS_ROLES):
        return
    if "customer" in auth.roles:
        if auth.customer_id == customer_id:
            return
        deny(auth, "AUTH_403_NOT_OWNER", risk_repo, customer_id)
    if "advisor" in auth.roles:
        if core_ro.is_advisor_assigned(auth.actor_id, customer_id):
            return
        deny(auth, "AUTH_403_NOT_ASSIGNED", risk_repo, customer_id)
    deny(auth, "AUTH_403_SCOPE", risk_repo, customer_id)