from __future__ import annotations

from fastapi import APIRouter, Depends, HTTPException, status

from fastapi.security import OAuth2PasswordRequestForm

from sqlalchemy import select

from sqlalchemy.orm import Session

from app.api.deps import get_current_user, get_db

from app.core.security import create_access_token, hash_password, verify_password

from app.models import AuditLog, User

from app.schemas import Token, UserCreate, UserOut

router = APIRouter(prefix="/auth", tags=["auth"])

@router.post("/register", response_model=UserOut, status_code=201)

def register(payload: UserCreate, db: Session = Depends(get_db)) -> User:

    if db.scalar(select(User).where(User.email == payload.email)):

        raise HTTPException(status.HTTP_409_CONFLICT, "email already registered")

    is_first = db.scalar(select(User).limit(1)) is None

    user = User(email=payload.email, hashed_password=hash_password(payload.password),

                full_name=payload.full_name, role="admin" if is_first else payload.role)

    db.add(user)

    db.flush()

    db.add(AuditLog(action="user.register", entity_type="user", entity_id=user.id))

    db.commit()

    db.refresh(user)

    return user

@router.post("/login", response_model=Token)

def login(form: OAuth2PasswordRequestForm = Depends(), db: Session = Depends(get_db)) -> Token:

    user = db.scalar(select(User).where(User.email == form.username))

    if not user or not verify_password(form.password, user.hashed_password):

        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "invalid credentials")

    db.add(AuditLog(actor_user_id=user.id, action="user.login", entity_type="user", entity_id=user.id))

    db.commit()

    return Token(access_token=create_access_token(user.id, user.role))

@router.get("/me", response_model=UserOut)

def me(user: User = Depends(get_current_user)) -> User:

    return user