from __future__ import annotations

from datetime import datetime, timezone

from fastapi import APIRouter, Depends, HTTPException

from pydantic import BaseModel

from sqlalchemy import select

from sqlalchemy.orm import Session

from app.api.deps import Perm, get_current_user, get_db, require

from app.core.security import generate_api_key

from app.models import ApiKey, AuditLog, User

router = APIRouter(prefix="/api-keys", tags=["api-keys"])

class ApiKeyCreate(BaseModel):

    name: str

    scopes: list[str] = []

@router.post("", status_code=201)

def create_key(payload: ApiKeyCreate, db: Session = Depends(get_db),

               user: User = Depends(get_current_user)):

    raw, key_hash = generate_api_key()

    key = ApiKey(user_id=user.id, name=payload.name, key_hash=key_hash,

                 scopes={"scopes": payload.scopes})

    db.add(key)

    db.flush()

    db.add(AuditLog(actor_user_id=user.id, action="apikey.create",

                    entity_type="api_key", entity_id=key.id, meta={"name": payload.name}))

    db.commit()

    db.refresh(key)

    return {"id": key.id, "name": key.name, "api_key": raw,

            "note": "Store this now - it will not be shown again."}

@router.get("")

def list_keys(db: Session = Depends(get_db), user: User = Depends(get_current_user)):

    rows = db.scalars(select(ApiKey).where(ApiKey.user_id == user.id)

                      .order_by(ApiKey.created_at.desc())).all()

    return [{"id": k.id, "name": k.name, "scopes": (k.scopes or {}).get("scopes", []),

             "last_used_at": k.last_used_at, "revoked_at": k.revoked_at,

             "created_at": k.created_at} for k in rows]

@router.delete("/{key_id}")

def revoke_key(key_id: str, db: Session = Depends(get_db), user: User = Depends(get_current_user)):

    key = db.get(ApiKey, key_id)

    if not key or key.user_id != user.id:

        raise HTTPException(404, "api key not found")

    key.revoked_at = datetime.now(timezone.utc)

    db.add(AuditLog(actor_user_id=user.id, action="apikey.revoke",

                    entity_type="api_key", entity_id=key.id))

    db.commit()

    return {"id": key_id, "revoked": True}