ctms/backend/app/api/v1/finance.py

import uuid
from datetime import date

from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles
from app.crud import audit as audit_crud
from app.crud import finance as finance_crud
from app.crud import study as study_crud
from app.schemas.finance import FinanceCreate, FinanceRead, FinanceStatusUpdate, FinanceUpdate

router = APIRouter()


async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
    study = await study_crud.get(db, study_id)
    if not study:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Study not found")
    return study


def _with_month(item: FinanceRead) -> FinanceRead:
    item.month = item.occur_date.strftime("%Y-%m")
    return item


@router.post(
    "/items",
    response_model=FinanceRead,
    status_code=status.HTTP_201_CREATED,
    dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
)
async def create_finance_item(
    study_id: uuid.UUID,
    item_in: FinanceCreate,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> FinanceRead:
    await _ensure_study_exists(db, study_id)
    try:
        item = await finance_crud.create_item(db, study_id, item_in, created_by=current_user.id)
    except ValueError as exc:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
    await audit_crud.log_action(
        db,
        study_id=study_id,
        entity_type="finance",
        entity_id=item.id,
        action="CREATE_FINANCE_ITEM",
        detail=f"Finance {item.id} created",
        operator_id=current_user.id,
        operator_role=current_user.role,
    )
    return _with_month(FinanceRead.model_validate(item))


@router.get(
    "/items",
    response_model=list[FinanceRead],
    dependencies=[Depends(require_study_member())],
)
async def list_finance_items(
    study_id: uuid.UUID,
    status_filter: str | None = None,
    category: str | None = None,
    site_id: uuid.UUID | None = None,
    subject_id: uuid.UUID | None = None,
    date_from: date | None = None,
    date_to: date | None = None,
    skip: int = 0,
    limit: int = 100,
    db: AsyncSession = Depends(get_db_session),
) -> list[FinanceRead]:
    await _ensure_study_exists(db, study_id)
    items = await finance_crud.list_items(
        db,
        study_id,
        status=status_filter,
        category=category,
        site_id=site_id,
        subject_id=subject_id,
        date_from=date_from,
        date_to=date_to,
        skip=skip,
        limit=limit,
    )
    return [_with_month(FinanceRead.model_validate(i)) for i in items]


@router.get(
    "/items/{item_id}",
    response_model=FinanceRead,
    dependencies=[Depends(require_study_member())],
)
async def get_finance_item(
    study_id: uuid.UUID,
    item_id: uuid.UUID,
    db: AsyncSession = Depends(get_db_session),
) -> FinanceRead:
    await _ensure_study_exists(db, study_id)
    item = await finance_crud.get_item(db, item_id)
    if not item or item.study_id != study_id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Finance item not found")
    return _with_month(FinanceRead.model_validate(item))


@router.patch(
    "/items/{item_id}",
    response_model=FinanceRead,
    dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
)
async def update_finance_item(
    study_id: uuid.UUID,
    item_id: uuid.UUID,
    item_in: FinanceUpdate,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> FinanceRead:
    await _ensure_study_exists(db, study_id)
    item = await finance_crud.get_item(db, item_id)
    if not item or item.study_id != study_id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Finance item not found")
    try:
        updated = await finance_crud.update_item_draft(db, item, item_in)
    except ValueError as exc:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
    await audit_crud.log_action(
        db,
        study_id=study_id,
        entity_type="finance",
        entity_id=item_id,
        action="UPDATE_FINANCE_ITEM",
        detail=f"Finance {item_id} updated",
        operator_id=current_user.id,
        operator_role=current_user.role,
    )
    return _with_month(FinanceRead.model_validate(updated))


@router.post(
    "/items/{item_id}/status",
    response_model=FinanceRead,
    dependencies=[Depends(require_study_member())],
)
async def change_finance_status(
    study_id: uuid.UUID,
    item_id: uuid.UUID,
    status_in: FinanceStatusUpdate,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> FinanceRead:
    await _ensure_study_exists(db, study_id)
    item = await finance_crud.get_item(db, item_id)
    if not item or item.study_id != study_id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Finance item not found")

    # permission by status target
    from app.crud import member as member_crud
    member = await member_crud.get_member(db, study_id, current_user.id)
    member_role = member.role_in_study if member else None

    target = status_in.status
    if target in {"SUBMITTED"}:
        if current_user.role != "ADMIN" and member_role not in {"PM", "CRA"}:
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Insufficient permissions")
    elif target in {"APPROVED", "REJECTED", "PAID"}:
        if current_user.role != "ADMIN" and member_role not in {"PM"}:
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Insufficient permissions")
    else:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Unsupported status")

    old_status = item.status
    try:
        updated = await finance_crud.change_status(db, item, status_in, operator_id=current_user.id)
    except ValueError as exc:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
    detail = f"Finance {item_id} {old_status} -> {status_in.status}"
    action = "FINANCE_STATUS_CHANGE"
    await audit_crud.log_action(
        db,
        study_id=study_id,
        entity_type="finance",
        entity_id=item_id,
        action=action,
        detail=detail,
        operator_id=current_user.id,
        operator_role=current_user.role,
    )
    return _with_month(FinanceRead.model_validate(updated))