ctms/backend/app/api/v1/faqs.py

import uuid

from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.deps import get_current_user, get_db_session
from app.crud import audit as audit_crud
from app.crud import faq_category as category_crud
from app.crud import faq_item as faq_crud
from app.crud import member as member_crud
from app.schemas.faq import FaqCreate, FaqRead, FaqUpdate

router = APIRouter()


def _check_write_permission(study_id: uuid.UUID | None, current_user, member_role: str | None):
    if study_id is None:
        if current_user.role != "ADMIN":
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Only admin can manage global FAQ")
    else:
        if current_user.role != "ADMIN" and member_role != "PM":
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Insufficient permissions")


@router.post(
    "/",
    response_model=FaqRead,
    status_code=status.HTTP_201_CREATED,
)
async def create_faq(
    payload: FaqCreate,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> FaqRead:
    cat = await category_crud.get_category(db, payload.category_id)
    if not cat:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Category not found")
    if cat.study_id != payload.study_id:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Category scope mismatch")
    member_role = None
    if payload.study_id:
        member = await member_crud.get_member(db, payload.study_id, current_user.id)
        member_role = member.role_in_study if member else None
    _check_write_permission(payload.study_id, current_user, member_role)
    try:
        item = await faq_crud.create_item(db, payload, created_by=current_user.id)
    except ValueError as exc:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
    await audit_crud.log_action(
        db,
        study_id=payload.study_id,
        entity_type="faq_item",
        entity_id=item.id,
        action="CREATE_FAQ_ITEM",
        detail="FAQ created",
        operator_id=current_user.id,
        operator_role=current_user.role,
    )
    return FaqRead.model_validate(item)


@router.get(
    "/",
    response_model=list[FaqRead],
)
async def list_faqs(
    study_id: uuid.UUID | None = None,
    category_id: uuid.UUID | None = None,
    keyword: str | None = None,
    is_active: bool | None = True,
    study_scope: str | None = "project",
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> list[FaqRead]:
    membership_cache: dict[uuid.UUID, str | None] = {}

    async def _get_member_role(sid: uuid.UUID) -> str | None:
        if sid in membership_cache:
            return membership_cache[sid]
        member = await member_crud.get_member(db, sid, current_user.id)
        role = member.role_in_study if member else None
        membership_cache[sid] = role
        return role

    if study_id:
        if current_user.role != "ADMIN":
            role = await _get_member_role(study_id)
            if not role:
                raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not a study member")

    if is_active is False and current_user.role != "ADMIN":
        role = None
        if study_id:
            role = await _get_member_role(study_id)
        if role != "PM":
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Insufficient permissions")

    items = await faq_crud.list_items(
        db,
        study_id=study_id,
        category_id=category_id,
        keyword=keyword,
        is_active=is_active,
        study_scope=study_scope,
    )

    visible: list[FaqRead] = []
    for it in items:
        if it.study_id and current_user.role != "ADMIN":
            role = await _get_member_role(it.study_id)
            if not role:
                continue
        if not it.is_active and current_user.role != "ADMIN":
            role = await _get_member_role(it.study_id) if it.study_id else None
            if role != "PM":
                continue
        visible.append(FaqRead.model_validate(it))
    return visible


@router.get(
    "/{item_id}",
    response_model=FaqRead,
)
async def get_faq(
    item_id: uuid.UUID,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> FaqRead:
    item = await faq_crud.get_item(db, item_id)
    if not item:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ not found")
    if item.study_id and current_user.role != "ADMIN":
        member = await member_crud.get_member(db, item.study_id, current_user.id)
        if not member:
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not a study member")
    if not item.is_active and current_user.role not in {"ADMIN"}:
        member_role = None
        if item.study_id:
            member = await member_crud.get_member(db, item.study_id, current_user.id)
            member_role = member.role_in_study if member else None
        if member_role != "PM":
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Inactive FAQ")
    return FaqRead.model_validate(item)


@router.patch(
    "/{item_id}",
    response_model=FaqRead,
)
async def update_faq(
    item_id: uuid.UUID,
    payload: FaqUpdate,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> FaqRead:
    item = await faq_crud.get_item(db, item_id)
    if not item:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ not found")
    member_role = None
    if item.study_id:
        member = await member_crud.get_member(db, item.study_id, current_user.id)
        member_role = member.role_in_study if member else None
    _check_write_permission(item.study_id, current_user, member_role)
    old_active = item.is_active
    updated = await faq_crud.update_item(db, item, payload)
    action = "UPDATE_FAQ_ITEM"
    detail = "FAQ updated"
    if payload.is_active is not None and payload.is_active != old_active:
        action = "FAQ_STATUS_CHANGE"
        detail = "FAQ disabled" if not payload.is_active else "FAQ enabled"
    await audit_crud.log_action(
        db,
        study_id=item.study_id,
        entity_type="faq_item",
        entity_id=item_id,
        action=action,
        detail=detail,
        operator_id=current_user.id,
        operator_role=current_user.role,
    )
    return FaqRead.model_validate(updated)