ctms/backend/app/api/v1/comments.py

import uuid

from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.deps import get_current_user, get_db_session, require_study_member
from app.crud import comment as comment_crud
from app.crud import audit as audit_crud
from app.crud import study as study_crud
from app.schemas.comment import CommentCreate, CommentRead, CommentQuote

router = APIRouter()


async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
    study = await study_crud.get(db, study_id)
    if not study:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Study not found")
    return study


@router.post(
    "/",
    response_model=CommentRead,
    status_code=status.HTTP_201_CREATED,
    dependencies=[Depends(require_study_member())],
)
async def create_comment(
    study_id: uuid.UUID,
    entity_type: str,
    entity_id: uuid.UUID,
    comment_in: CommentCreate,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> CommentRead:
    await _ensure_study_exists(db, study_id)
    quote = None
    if comment_in.quote_comment_id:
        quote = await comment_crud.get_comment(db, comment_in.quote_comment_id, include_deleted=True)
        if (
            not quote
            or quote.study_id != study_id
            or quote.entity_type != entity_type
            or quote.entity_id != entity_id
        ):
            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="引用评论不存在")
        if quote.is_deleted:
            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="引用评论已删除")
    comment = await comment_crud.create_comment(
        db,
        study_id=study_id,
        entity_type=entity_type,
        entity_id=entity_id,
        comment_in=comment_in,
        created_by=current_user.id,
    )
    await audit_crud.log_action(
        db,
        study_id=study_id,
        entity_type=entity_type,
        entity_id=entity_id,
        action="CREATE_COMMENT",
        detail=f"Comment created by {current_user.full_name}",
        operator_id=current_user.id,
        operator_role=current_user.role,
    )
    return CommentRead(
        id=comment.id,
        content=comment.content,
        created_by=comment.created_by,
        created_at=comment.created_at,
        quote_comment_id=comment.quote_comment_id,
        quote=CommentQuote.model_validate(quote) if quote else None,
        is_deleted=comment.is_deleted,
    )


@router.get(
    "/",
    response_model=list[CommentRead],
    dependencies=[Depends(require_study_member())],
)
async def list_comments(
    study_id: uuid.UUID,
    entity_type: str,
    entity_id: uuid.UUID,
    db: AsyncSession = Depends(get_db_session),
) -> list[CommentRead]:
    await _ensure_study_exists(db, study_id)
    comments = await comment_crud.list_comments(db, study_id, entity_type, entity_id)
    quote_ids = {c.quote_comment_id for c in comments if c.quote_comment_id}
    quote_map = await comment_crud.get_comments_by_ids(db, quote_ids, include_deleted=True)
    return [
        CommentRead(
            id=c.id,
            content=c.content,
            created_by=c.created_by,
            created_at=c.created_at,
            quote_comment_id=c.quote_comment_id,
            quote=CommentQuote.model_validate(quote_map.get(c.quote_comment_id)) if c.quote_comment_id else None,
            is_deleted=c.is_deleted,
        )
        for c in comments
    ]


@router.delete(
    "/{comment_id}",
    status_code=status.HTTP_204_NO_CONTENT,
    dependencies=[Depends(require_study_member())],
)
async def delete_comment(
    study_id: uuid.UUID,
    entity_type: str,
    entity_id: uuid.UUID,
    comment_id: uuid.UUID,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
):
    await _ensure_study_exists(db, study_id)
    comment = await comment_crud.get_comment(db, comment_id, include_deleted=True)
    if (
        not comment
        or comment.study_id != study_id
        or comment.entity_type != entity_type
        or comment.entity_id != entity_id
    ):
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Comment not found")
    role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
    if role_value != "ADMIN" and comment.created_by != current_user.id:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Insufficient permissions")
    if comment.is_deleted:
        return
    await comment_crud.soft_delete_comment(db, comment)
    await audit_crud.log_action(
        db,
        study_id=study_id,
        entity_type=entity_type,
        entity_id=entity_id,
        action="DELETE_COMMENT",
        detail=f"Comment deleted by {current_user.full_name}",
        operator_id=current_user.id,
        operator_role=current_user.role,
    )