from __future__ import annotations

from collections.abc import Generator

from fastapi import Depends, Header, HTTPException, status

from fastapi.security import OAuth2PasswordBearer

from jose import JWTError

from sqlalchemy.orm import Session

from datetime import datetime, timezone

from sqlalchemy import select

from app.core.permissions import Perm, role_has

from app.core.security import decode_token, hash_api_key

from app.db.session import get_db

from app.models import ApiKey, User

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/v1/auth/login", auto_error=False)

def get_current_user(

    token: str | None = Depends(oauth2_scheme),

    x_api_key: str | None = Header(default=None),

    db: Session = Depends(get_db),

) -> User:

    if x_api_key:

        key = db.scalar(select(ApiKey).where(ApiKey.key_hash == hash_api_key(x_api_key)))

        if key is None or key.revoked_at is not None:

            raise HTTPException(status.HTTP_401_UNAUTHORIZED, "invalid or revoked api key")

        key.last_used_at = datetime.now(timezone.utc)

        db.commit()

        user = db.get(User, key.user_id)

        if user is None or not user.is_active:

            raise HTTPException(status.HTTP_401_UNAUTHORIZED, "api key owner inactive")

        return user

    if not token:

        from app.core.config import settings

        if settings.open_mode:

            user = db.scalar(select(User).where(User.role == "admin").order_by(User.created_at)) \

                or db.scalar(select(User).order_by(User.created_at))

            if user:

                return user

        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "missing credentials")

    try:

        payload = decode_token(token)

    except JWTError:

        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "invalid token")

    user = db.get(User, payload.get("sub"))

    if user is None or not user.is_active:

        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "user not found or inactive")

    return user

def require(perm: Perm):

    def _dep(user: User = Depends(get_current_user)) -> User:

        if not role_has(user.role, perm):

            raise HTTPException(status.HTTP_403_FORBIDDEN, f"requires permission: {perm.value}")

        return user

    return _dep

__all__ = ["get_db", "get_current_user", "require", "Perm", "Session", "Generator"]