from datetime import datetime
from fastapi import APIRouter, Depends, HTTPException, status, Response
from fastapi.security import OAuth2PasswordRequestForm
from sqlalchemy.orm import Session
from app.database import get_db
from app.schemas.auth import Token, AdminUserResponse, ChangePasswordRequest, LoginRequest
from app.services.auth_service import (
    authenticate_admin,
    create_access_token,
    get_current_admin,
    verify_password,
    get_password_hash
)
from app.models.admin import AdminUser
from app.config import settings

router = APIRouter(prefix="/api/auth", tags=["Authentication"])

@router.post("/login", response_model=Token)
async def login(
    login_data: LoginRequest,
    response: Response,
    db: Session = Depends(get_db)
):
    admin = authenticate_admin(db, login_data.username, login_data.password)
    if not admin:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect username or password",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    # Update last login
    admin.last_login = datetime.utcnow()
    db.commit()

    access_token = create_access_token(data={"sub": admin.username, "role": admin.role})
    
    # Set HttpOnly cookie for web security
    response.set_cookie(
        key="admin_access_token",
        value=access_token,
        httponly=True,
        max_age=settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60,
        samesite="lax",
        secure=False # Set to True in HTTPS production
    )

    return Token(
        access_token=access_token,
        token_type="bearer",
        expires_in=settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60,
        user_name=admin.full_name,
        username=admin.username
    )

@router.post("/logout")
async def logout(response: Response):
    response.delete_cookie(key="admin_access_token")
    return {"message": "Logged out successfully"}

@router.get("/me", response_model=AdminUserResponse)
async def get_me(current_admin: AdminUser = Depends(get_current_admin)):
    return current_admin

@router.post("/change-password")
async def change_password(
    req: ChangePasswordRequest,
    current_admin: AdminUser = Depends(get_current_admin),
    db: Session = Depends(get_db)
):
    if not verify_password(req.current_password, current_admin.hashed_password):
        raise HTTPException(status_code=400, detail="Current password is incorrect")
    
    if len(req.new_password) < 6:
        raise HTTPException(status_code=400, detail="New password must be at least 6 characters")

    current_admin.hashed_password = get_password_hash(req.new_password)
    db.commit()
    return {"message": "Password updated successfully"}