import uuid

from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.deps import get_db_session, require_roles
from app.core.security import verify_password
from app.schemas.common import PaginatedResponse
from app.crud import user as user_crud
from app.crud import member as member_crud
from app.utils.pagination import paginate
from app.schemas.user import UserCreate, UserRead, UserUpdate

router = APIRouter()


@router.get("/", response_model=PaginatedResponse[UserRead], summary="用户列表", description="仅 ADMIN 可用，支持 skip/limit。")
async def list_users(
    skip: int = 0,
    limit: int = 100,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(require_roles(["ADMIN"])),
) -> PaginatedResponse[UserRead]:
    users = await user_crud.list_users(db, skip=skip, limit=limit)
    total_users = await user_crud.list_users(db, skip=0, limit=10_000_000)
    return paginate(list(users), total=len(total_users))


@router.post("/", response_model=UserRead, status_code=status.HTTP_201_CREATED)
async def create_user(
    user_in: UserCreate,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(require_roles(["ADMIN"])),
) -> UserRead:
    existing = await user_crud.get_by_email(db, user_in.email)
    if existing:
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail="Email already exists",
        )
    user = await user_crud.create_user(db, user_in)
    return user


@router.patch("/{user_id}", response_model=UserRead)
async def update_user(
    user_id: uuid.UUID,
    user_in: UserUpdate,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(require_roles(["ADMIN"])),
) -> UserRead:
    db_user = await user_crud.get_by_id(db, user_id)
    if not db_user:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
    if db_user.role.value == "ADMIN":
        requested_role = user_in.role
        requested_status = user_in.status
        if user_in.is_active is not None:
            requested_status = "ACTIVE" if user_in.is_active else "DISABLED"
        will_leave_admin = requested_role is not None and requested_role != "ADMIN"
        will_disable = requested_status is not None and requested_status != "ACTIVE"
        if (will_leave_admin or will_disable) and db_user.status.value == "ACTIVE":
            active_admins = await user_crud.count_active_admins(db)
            if active_admins <= 1:
                raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="至少保留一个管理员账号")
    user = await user_crud.update_user(db, db_user, user_in)
    return user


@router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_user(
    user_id: uuid.UUID,
    payload: dict,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(require_roles(["ADMIN"])),
):
    admin_password = payload.get("admin_password")
    if not admin_password or not verify_password(admin_password, current_user.password_hash):
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="管理员密码错误")
    db_user = await user_crud.get_by_id(db, user_id)
    if not db_user:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
    if db_user.id == current_user.id:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="不允许删除自己")
    if db_user.role.value == "ADMIN" and db_user.status.value == "ACTIVE":
        active_admins = await user_crud.count_active_admins(db)
        if active_admins <= 1:
            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="至少保留一个管理员账号")
    has_membership = await member_crud.user_has_memberships(db, db_user.id)
    if has_membership:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="该账号仍在项目成员中，请先在项目成员配置中移除后再删除",
        )
    await user_crud.delete_user(db, db_user)