"""用户管理 API"""
from fastapi import APIRouter, Depends, Query, HTTPException
from sqlalchemy.orm import Session
from sqlalchemy import asc

from app.core.database import get_db
from app.middleware.permission_middleware import require_permission
from app.models.user import User
from app.schemas.user import UserListResponse, UserListItem, UserRoleUpdate

router = APIRouter(prefix="/api/users", tags=["用户管理"])

VALID_ROLES = {'admin', 'area_admin', 'school_admin', 'user'}


@router.get("", response_model=UserListResponse)
def get_users(
    skip: int = Query(0, ge=0),
    limit: int = Query(20, ge=1, le=100),
    role: str = None,
    keyword: str = None,
    db: Session = Depends(get_db),
    _: dict = Depends(require_permission('user.view')),
):
    """获取用户列表"""
    query = db.query(User)
    if role:
        query = query.filter(User.role == role)
    if keyword:
        query = query.filter(
            User.username.contains(keyword) | User.display_name.contains(keyword) | User.email.contains(keyword)
        )
    query = query.order_by(asc(User.created_at))
    total = query.count()
    items = query.offset(skip).limit(limit).all()
    return {"total": total, "items": items}


@router.put("/{user_id}/role")
def update_user_role(
    user_id: int,
    body: UserRoleUpdate,
    db: Session = Depends(get_db),
    current: dict = Depends(require_permission('user.manage')),
):
    """修改用户角色及分配区域/学校"""
    if body.role not in VALID_ROLES:
        raise HTTPException(status_code=400, detail=f"无效角色，可选：{', '.join(VALID_ROLES)}")

    user = db.query(User).filter(User.id == user_id).first()
    if not user:
        raise HTTPException(status_code=404, detail="用户不存在")

    # 不允许修改自己的角色
    if str(user.id) == current.get('sub'):
        raise HTTPException(status_code=400, detail="不能修改自己的角色")

    user.role = body.role
    user.assigned_area = body.assigned_area
    user.assigned_school = body.assigned_school
    db.commit()
    return {"message": "更新成功"}


@router.put("/{user_id}/toggle")
def toggle_user(
    user_id: int,
    db: Session = Depends(get_db),
    current: dict = Depends(require_permission('user.manage')),
):
    """启用/禁用用户"""
    user = db.query(User).filter(User.id == user_id).first()
    if not user:
        raise HTTPException(status_code=404, detail="用户不存在")

    if str(user.id) == current.get('sub'):
        raise HTTPException(status_code=400, detail="不能禁用自己")

    user.is_active = not user.is_active
    db.commit()
    return {"message": "已禁用" if not user.is_active else "已启用", "is_active": user.is_active}