from __future__ import annotations

import hashlib

from fastapi import APIRouter, Depends, File, Form, HTTPException, Response, UploadFile

from sqlalchemy import select

from sqlalchemy.orm import Session

from app.api.deps import Perm, get_db, require

from app.core.config import settings

from app.core.storage import get_storage

from app.models import AuditLog, EvidenceFile, Investigation, Source, User

router = APIRouter(tags=["evidence"])

@router.post("/investigations/{inv_id}/evidence", status_code=201)

async def upload_evidence(

    inv_id: str,

    file: UploadFile = File(...),

    description: str | None = Form(default=None),

    source_id: str | None = Form(default=None),

    db: Session = Depends(get_db),

    user: User = Depends(require(Perm.WRITE)),

):

    if not db.get(Investigation, inv_id):

        raise HTTPException(404, "investigation not found")

    data = await file.read()

    if not data:

        raise HTTPException(400, "empty file")

    if len(data) > settings.max_upload_bytes:

        raise HTTPException(413, f"file exceeds {settings.max_upload_bytes} bytes")

    sha = hashlib.sha256(data).hexdigest()

    if source_id and not db.get(Source, source_id):

        raise HTTPException(400, "unknown source_id")

    blob_ref = get_storage().put(f"evidence/{inv_id}/{sha[:16]}_{file.filename}", data)

    ev = EvidenceFile(investigation_id=inv_id, filename=file.filename,

                      content_type=file.content_type, size_bytes=len(data), sha256=sha,

                      blob_ref=blob_ref, source_id=source_id, description=description,

                      uploaded_by=user.id)

    db.add(ev)

    db.flush()

    db.add(AuditLog(actor_user_id=user.id, action="evidence.upload",

                    entity_type="evidence_file", entity_id=ev.id,

                    meta={"investigation_id": inv_id, "filename": file.filename, "sha256": sha}))

    db.commit()

    db.refresh(ev)

    return {"id": ev.id, "filename": ev.filename, "sha256": ev.sha256, "size_bytes": ev.size_bytes}

@router.get("/investigations/{inv_id}/evidence")

def list_evidence(inv_id: str, db: Session = Depends(get_db), _: User = Depends(require(Perm.READ))):

    rows = db.scalars(select(EvidenceFile).where(EvidenceFile.investigation_id == inv_id)

                      .order_by(EvidenceFile.created_at.desc())).all()

    return [{"id": e.id, "filename": e.filename, "content_type": e.content_type,

             "size_bytes": e.size_bytes, "sha256": e.sha256, "source_id": e.source_id,

             "description": e.description, "uploaded_by": e.uploaded_by,

             "created_at": e.created_at} for e in rows]

@router.get("/evidence/{evidence_id}")

def get_evidence(evidence_id: str, db: Session = Depends(get_db), _: User = Depends(require(Perm.READ))):

    ev = db.get(EvidenceFile, evidence_id)

    if not ev:

        raise HTTPException(404, "evidence not found")

    trail = db.scalars(select(AuditLog).where(AuditLog.entity_type == "evidence_file",

                                              AuditLog.entity_id == evidence_id)

                       .order_by(AuditLog.created_at)).all()

    return {"id": ev.id, "investigation_id": ev.investigation_id, "filename": ev.filename,

            "content_type": ev.content_type, "size_bytes": ev.size_bytes, "sha256": ev.sha256,

            "source_id": ev.source_id, "description": ev.description, "uploaded_by": ev.uploaded_by,

            "created_at": ev.created_at,

            "chain_of_custody": [{"action": t.action, "actor": t.actor_user_id,

                                  "at": t.created_at, "metadata": t.meta} for t in trail]}

@router.get("/evidence/{evidence_id}/download")

def download_evidence(evidence_id: str, db: Session = Depends(get_db),

                      user: User = Depends(require(Perm.READ))):

    ev = db.get(EvidenceFile, evidence_id)

    if not ev:

        raise HTTPException(404, "evidence not found")

    try:

        data = get_storage().get(ev.blob_ref)

    except Exception:

        raise HTTPException(410, "evidence blob unavailable")

    actual = hashlib.sha256(data).hexdigest()

    integrity_ok = actual == ev.sha256

    db.add(AuditLog(actor_user_id=user.id, action="evidence.download",

                    entity_type="evidence_file", entity_id=ev.id,

                    meta={"integrity_ok": integrity_ok}))

    db.commit()

    return Response(content=data, media_type=ev.content_type or "application/octet-stream",

                    headers={"Content-Disposition": f'attachment; filename="{ev.filename}"',

                             "X-Content-SHA256": ev.sha256,

                             "X-Integrity-Verified": str(integrity_ok).lower()})