import logging
from datetime import datetime, timedelta

from fastapi import APIRouter, Depends, HTTPException, Request
from pydantic import BaseModel

from .. import config, db, security, wechat
from ..user import user_payload


logger = logging.getLogger(__name__)

router = APIRouter(prefix="/api/v1/auth", tags=["auth"])


class WeChatLoginRequest(BaseModel):
    code: str


class BindPhoneRequest(BaseModel):
    code: str
    phone_code: str


def get_current_user(request: Request):
    token = ""

    # 1. 优先从 Authorization header 取（小程序 API 调用方式）
    auth = request.headers.get("Authorization", "")
    if auth.startswith("Bearer "):
        token = auth[7:]

    # 2. header 没有则从 cookie 取（webview H5 页面内请求方式）
    if not token:
        token = request.cookies.get("auth_token", "")

    if not token:
        raise HTTPException(status_code=401, detail="缺少 token")

    session = db.fetch_one(
        "SELECT s.user_id AS id FROM auth_sessions s "
        "WHERE s.token=%s AND s.expires_at>NOW()",
        (token,),
    )
    if not session:
        raise HTTPException(status_code=401, detail="token 无效或过期")
    user = db.fetch_one("SELECT * FROM auth_users WHERE id=%s", (session["id"],))
    if not user:
        raise HTTPException(status_code=401, detail="用户不存在")
    return user


def _record_session(user_id):
    """创建会话 token 并写入 auth_sessions。"""
    token = security.create_session_token()
    expires = datetime.now() + timedelta(seconds=config.JWT_TTL_SECONDS)
    db.execute(
        "INSERT INTO auth_sessions (user_id, token, expires_at) VALUES (%s, %s, %s)",
        (user_id, token, expires),
    )
    return token


@router.post("/wechat-login")
def wechat_login(req: WeChatLoginRequest):
    try:
        openid = wechat.code_to_openid(req.code)
    except wechat.WeChatError as exc:
        logger.warning("微信登录 code 换取 openid 失败: %s", exc)
        raise HTTPException(status_code=400, detail=str(exc))

    user = db.fetch_one("SELECT * FROM auth_users WHERE wechat_openid=%s", (openid,))
    if user:
        token = _record_session(user["id"])
        return {"success": True, "is_new": False, "token": token, **user_payload(user)}

    return {"success": False, "need_phone": True, "error": "需要绑定手机号"}


@router.post("/bind-phone")
def bind_phone(req: BindPhoneRequest):
    try:
        openid = wechat.code_to_openid(req.code)
        phone = wechat.get_phone_number(req.phone_code)
    except wechat.WeChatError as exc:
        logger.warning("绑定手机号时获取微信信息失败: %s", exc)
        raise HTTPException(status_code=400, detail=str(exc))

    if not phone:
        raise HTTPException(status_code=400, detail="获取手机号失败")

    encrypted = security.encrypt_phone(phone)
    user = db.fetch_one("SELECT * FROM auth_users WHERE phone_encrypted=%s", (encrypted,))
    if not user:
        return {"success": False, "error": "手机号未匹配，无法登录"}

    db.execute("UPDATE auth_users SET wechat_openid=%s WHERE id=%s", (openid, user["id"]))
    user["wechat_openid"] = openid
    token = _record_session(user["id"])
    return {"success": True, "is_new": True, "token": token, **user_payload(user)}


@router.get("/verify")
def verify(user=Depends(get_current_user)):
    return {"success": True, **user_payload(user)}


@router.post("/logout")
def logout(request: Request, user=Depends(get_current_user)):
    from fastapi.responses import JSONResponse

    auth = request.headers.get("Authorization", "")
    if auth.startswith("Bearer "):
        db.execute("DELETE FROM auth_sessions WHERE token=%s", (auth[7:],))
    # 退出登录时解除该用户手机号绑定的微信 openid，下次需重新授权手机号绑定
    db.execute(
        "UPDATE auth_users SET wechat_openid=NULL WHERE id=%s",
        (user["id"],),
    )
    resp = JSONResponse(content={"success": True})
    # 同时清除 webview cookie 登录态
    resp.delete_cookie(key="auth_token", path="/")
    return resp