"""Optional OIDC / SSO login. Disabled unless SIGHTLINE_OIDC_ENABLED=true and an issuer is

configured. Implements the standard authorization-code flow:

    /auth/oidc/login     -> redirect to the IdP authorize endpoint (state signed with our key)

    /auth/oidc/callback  -> exchange code, read userinfo, upsert the user, mint a local JWT

Local username/password JWT remains the primary auth path; this lets Sightline drop into an

existing identity provider (Okta, Auth0, Keycloak, Entra ID, Google) without code changes.

NOTE: fully exercising this requires a reachable IdP, so it is config-gated and not part of the

automated demo. The discovery + token exchange use standard OIDC endpoints."""

from __future__ import annotations

from datetime import datetime, timedelta, timezone

import httpx

from fastapi import APIRouter, Depends, HTTPException, Query

from fastapi.responses import RedirectResponse

from jose import jwt, JWTError

from sqlalchemy import select

from sqlalchemy.orm import Session

from app.api.deps import get_db

from app.core.config import settings

from app.core.security import create_access_token, generate_api_key

from app.models import AuditLog, User

router = APIRouter(prefix="/auth/oidc", tags=["auth"])

_STATE_TTL = 600

def _require_enabled():

    if not settings.oidc_enabled or not settings.oidc_issuer:

        raise HTTPException(501, "OIDC not enabled (set SIGHTLINE_OIDC_ENABLED and issuer)")

def _discover() -> dict:

    url = settings.oidc_issuer.rstrip("/") + "/.well-known/openid-configuration"

    r = httpx.get(url, timeout=10.0)

    r.raise_for_status()

    return r.json()

def _sign_state() -> str:

    now = datetime.now(timezone.utc)

    return jwt.encode({"k": "oidc_state", "iat": now, "exp": now + timedelta(seconds=_STATE_TTL)},

                      settings.secret_key, algorithm=settings.jwt_algorithm)

def _verify_state(state: str) -> bool:

    try:

        payload = jwt.decode(state, settings.secret_key, algorithms=[settings.jwt_algorithm])

        return payload.get("k") == "oidc_state"

    except JWTError:

        return False

@router.get("/login")

def oidc_login():

    _require_enabled()

    try:

        conf = _discover()

    except Exception as e:

        raise HTTPException(502, f"OIDC discovery failed: {e}")

    params = {

        "response_type": "code",

        "client_id": settings.oidc_client_id,

        "redirect_uri": settings.oidc_redirect_uri,

        "scope": "openid email profile",

        "state": _sign_state(),

    }

    q = "&".join(f"{k}={httpx.QueryParams({k: v})[k]}" for k, v in params.items())

    return RedirectResponse(f"{conf['authorization_endpoint']}?{q}")

@router.get("/callback")

def oidc_callback(code: str = Query(...), state: str = Query(...), db: Session = Depends(get_db)):

    _require_enabled()

    if not _verify_state(state):

        raise HTTPException(400, "invalid or expired state")

    try:

        conf = _discover()

        token_resp = httpx.post(conf["token_endpoint"], data={

            "grant_type": "authorization_code", "code": code,

            "redirect_uri": settings.oidc_redirect_uri,

            "client_id": settings.oidc_client_id,

            "client_secret": settings.oidc_client_secret,

        }, timeout=10.0)

        token_resp.raise_for_status()

        access = token_resp.json()["access_token"]

        userinfo = httpx.get(conf["userinfo_endpoint"],

                             headers={"Authorization": f"Bearer {access}"}, timeout=10.0).json()

    except Exception as e:

        raise HTTPException(502, f"OIDC token exchange failed: {e}")

    email = userinfo.get("email")

    if not email:

        raise HTTPException(400, "IdP did not return an email claim")

    user = db.scalar(select(User).where(User.email == email))

    if user is None:

        _, pw_hash = generate_api_key()

        user = User(email=email, hashed_password=pw_hash,

                    full_name=userinfo.get("name"), role=settings.oidc_default_role)

        db.add(user)

        db.flush()

    db.add(AuditLog(actor_user_id=user.id, action="user.login.oidc",

                    entity_type="user", entity_id=user.id, meta={"issuer": settings.oidc_issuer}))

    db.commit()

    token = create_access_token(user.id, user.role)

    return RedirectResponse(f"http://localhost:3000/login?token={token}")