"""用户管理 API（管理员）"""
from fastapi import APIRouter, Depends, HTTPException
from pydantic import BaseModel
from sqlalchemy import select, update
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.deps import get_db
from app.core.auth import get_current_user, require_admin
from app.models.user import User, UserRoleEnum

router = APIRouter(prefix="/api/users", tags=["用户管理"])


@router.get("")
async def list_users(
    db: AsyncSession = Depends(get_db),
    admin: User = Depends(require_admin),
):
    """获取所有用户"""
    result = await db.execute(select(User).order_by(User.id))
    users = result.scalars().all()
    return [
        {
            "id": u.id,
            "username": u.username,
            "display_name": u.display_name,
            "role": u.role.value,
            "is_active": u.is_active,
            "last_login_at": u.last_login_at,
            "created_at": u.created_at,
        }
        for u in users
    ]


class UpdateUserRoleRequest(BaseModel):
    role: str  # "admin" or "viewer"



@router.put("/{user_id}/role")
async def update_user_role(
    user_id: int,
    data: UpdateUserRoleRequest,
    db: AsyncSession = Depends(get_db),
    admin: User = Depends(require_admin),
):
    """更新用户角色"""
    if data.role not in ("admin", "viewer"):
        raise HTTPException(status_code=400, detail="无效角色")
    if user_id == admin.id:
        raise HTTPException(status_code=400, detail="不能修改自己的角色")

    new_role = UserRoleEnum.admin if data.role == "admin" else UserRoleEnum.viewer
    await db.execute(update(User).where(User.id == user_id).values(role=new_role))
    await db.commit()
    return {"message": "更新成功"}