"""
Authentication and Authorization for Mitai Jinkendo

Provides password hashing, session management, and auth dependencies
for FastAPI endpoints.
"""
import hashlib
import secrets
from typing import Optional
from datetime import datetime, timedelta
from fastapi import Header, Query, HTTPException
import bcrypt

from db import get_db, get_cursor
from media_grant import profile_id_from_media_grant

# Fester bcrypt-Hash, damit ein unbekannter Login dieselbe Rechenzeit hat wie ein Treffer.
_LOGIN_TIMING_HASH = "$2b$12$GYdnAmeiqaZg/.5J9E4f4.xhz70piViqXIpqKCY/FY609qj65sc9i"
MAX_SESSION_DAYS = 30


def hash_pin(pin: str) -> str:
    """Hash password with bcrypt. Falls back gracefully from legacy SHA256."""
    return bcrypt.hashpw(pin.encode(), bcrypt.gensalt()).decode()


def verify_pin(pin: str, stored_hash: str) -> bool:
    """Verify password - supports both bcrypt and legacy SHA256."""
    if not stored_hash:
        return False
    # Detect bcrypt hash (starts with $2b$ or $2a$)
    if stored_hash.startswith('$2'):
        try:
            return bcrypt.checkpw(pin.encode(), stored_hash.encode())
        except Exception:
            return False
    # Legacy SHA256 support (auto-upgrade to bcrypt on next login)
    return stored_hash == hashlib.sha256(pin.encode()).hexdigest()


def verify_pin_for_login(pin: str, stored_hash: Optional[str]) -> bool:
    """Immer ein bcrypt-Vergleich, auch wenn das Konto fehlt (kein Zeit-Orakel)."""
    if stored_hash and str(stored_hash).startswith("$2"):
        return verify_pin(pin, stored_hash)
    verify_pin(pin or "x", _LOGIN_TIMING_HASH)
    if not stored_hash:
        return False
    return verify_pin(pin, stored_hash)


def session_lifetime_days(profile: Optional[dict]) -> int:
    raw = profile.get("session_days") if profile else None
    try:
        days = int(raw) if raw is not None else MAX_SESSION_DAYS
    except (TypeError, ValueError):
        days = MAX_SESSION_DAYS
    if days < 1:
        days = 1
    if days > MAX_SESSION_DAYS:
        days = MAX_SESSION_DAYS
    return days


def revoke_profile_sessions(cur, profile_id: int) -> None:
    """Alle Sitzungen eines Profils entfernen, inklusive Reset- und 2FA-Zwischentokens."""
    cur.execute("DELETE FROM sessions WHERE profile_id = %s", (profile_id,))


def make_token() -> str:
    """Generate a secure random token for sessions."""
    return secrets.token_urlsafe(32)


def get_session(token: str):
    """
    Get session data for a given token.

    Returns session dict with profile info, or None if invalid/expired.
    """
    if not token:
        return None
    with get_db() as conn:
        cur = get_cursor(conn)
        cur.execute(
            "SELECT s.*, p.role, p.name "
            "FROM sessions s JOIN profiles p ON s.profile_id=p.id "
            "WHERE s.token=%s AND s.expires_at > CURRENT_TIMESTAMP "
            "AND COALESCE(s.purpose, 'full') = 'full'",
            (token,)
        )
        return cur.fetchone()


def get_limited_session(token: str, purpose: str):
    """Sitzung mit festem Zweck (totp_enroll, totp_challenge). Kein Fach-API-Zugriff."""
    if not token or purpose not in ("totp_enroll", "totp_challenge"):
        return None
    with get_db() as conn:
        cur = get_cursor(conn)
        cur.execute(
            "SELECT s.*, p.role, p.name, p.email "
            "FROM sessions s JOIN profiles p ON s.profile_id=p.id "
            "WHERE s.token=%s AND s.expires_at > CURRENT_TIMESTAMP "
            "AND s.purpose = %s",
            (token, purpose),
        )
        return cur.fetchone()


def _profile_session_from_id(profile_id: int) -> Optional[dict]:
    with get_db() as conn:
        cur = get_cursor(conn)
        cur.execute(
            "SELECT id AS profile_id, role, name FROM profiles WHERE id = %s",
            (profile_id,),
        )
        return cur.fetchone()


def require_auth(x_auth_token: Optional[str] = Header(default=None)):
    """
    FastAPI dependency - requires valid authentication.

    Usage:
        @app.get("/api/endpoint")
        def endpoint(session: dict = Depends(require_auth)):
            profile_id = session['profile_id']
            ...

    Raises:
        HTTPException 401 if not authenticated
    """
    session = get_session(x_auth_token)
    if not session:
        raise HTTPException(401, "Nicht eingeloggt")
    return session


def require_auth_flexible(x_auth_token: Optional[str] = Header(default=None), ssetoken: Optional[str] = Query(default=None)):
    """
    FastAPI dependency - auth via header OR query parameter.

    Dateiabruf für <img>/<video>: Header-Sitzung oder kurzlebiges Medien-Token (?ssetoken).
    Ein Sitzungstoken in der Query-Zeichenfolge wird nicht akzeptiert.

    Usage:
        @app.get("/api/photos/{id}")
        def get_photo(id: str, session: dict = Depends(require_auth_flexible)):
            ...

    Call with: ?ssetoken=XXX or Header: X-Auth-Token: XXX

    Raises:
        HTTPException 401 if not authenticated
    """
    session = get_session(x_auth_token) if x_auth_token else None
    if session:
        return session
    profile_id = profile_id_from_media_grant(ssetoken)
    if profile_id is None:
        raise HTTPException(401, "Nicht eingeloggt")
    session = _profile_session_from_id(profile_id)
    if not session:
        raise HTTPException(401, "Nicht eingeloggt")
    return session


def require_admin(x_auth_token: Optional[str] = Header(default=None)):
    """
    FastAPI dependency - requires admin authentication.

    Usage:
        @app.put("/api/admin/endpoint")
        def admin_endpoint(session: dict = Depends(require_admin)):
            ...

    Raises:
        HTTPException 401 if not authenticated
        HTTPException 403 if not admin
    """
    session = get_session(x_auth_token)
    if not session:
        raise HTTPException(401, "Nicht eingeloggt")
    if session.get("role") not in ("admin", "superadmin"):
        raise HTTPException(403, "Nur für Admins")
    return session


# ============================================================================
# Feature Access Control (v9c)
# ============================================================================

def get_effective_tier(profile_id: str, conn=None) -> str:
    """
    Get the effective tier for a profile.

    Checks for active access_grants first (from coupons, trials, etc.),
    then falls back to profile.tier.

    Args:
        profile_id: User profile ID
        conn: Optional existing DB connection (to avoid pool exhaustion)

    Returns:
        tier_id (str): 'free', 'basic', 'premium', or 'selfhosted'
    """
    # Use existing connection if provided, otherwise open new one
    if conn:
        cur = get_cursor(conn)

        # Check for active access grants (highest priority)
        cur.execute("""
            SELECT tier_id
            FROM access_grants
            WHERE profile_id = %s
              AND is_active = true
              AND valid_from <= CURRENT_TIMESTAMP
              AND valid_until > CURRENT_TIMESTAMP
            ORDER BY valid_until DESC
            LIMIT 1
        """, (profile_id,))

        grant = cur.fetchone()
        if grant:
            return grant['tier_id']

        # Fall back to profile tier
        cur.execute("SELECT tier FROM profiles WHERE id = %s", (profile_id,))
        profile = cur.fetchone()
        return profile['tier'] if profile else 'free'
    else:
        # Open new connection if none provided
        with get_db() as conn:
            return get_effective_tier(profile_id, conn)


def check_feature_access(profile_id: str, feature_id: str, conn=None) -> dict:
    """
    DEPRECATED für Shinkan: Mitai-v9c-Profil-Limits — Schema 001 ist archiviert (Migration 078).

    Für Vereins-Kontingente: club_features.check_club_feature_access(club_id, feature_id).

    Check if a profile has access to a feature.

    Access hierarchy:
    1. User-specific restriction (user_feature_restrictions)
    2. Tier limit (tier_limits)
    3. Feature default (features.default_limit)

    Args:
        profile_id: User profile ID
        feature_id: Feature ID to check
        conn: Optional existing DB connection (to avoid pool exhaustion)

    Returns:
        dict: {
            'allowed': bool,
            'limit': int | None,  # NULL = unlimited
            'used': int,
            'remaining': int | None,  # NULL = unlimited
            'reason': str  # 'unlimited', 'within_limit', 'limit_exceeded', 'feature_disabled'
        }
    """
    # Use existing connection if provided
    if conn:
        return _check_impl(profile_id, feature_id, conn)
    else:
        with get_db() as conn:
            return _check_impl(profile_id, feature_id, conn)


def _check_impl(profile_id: str, feature_id: str, conn) -> dict:
    """Internal implementation of check_feature_access."""
    cur = get_cursor(conn)

    # Get feature info
    cur.execute("""
        SELECT limit_type, reset_period, default_limit
        FROM features
        WHERE id = %s AND active = true
    """, (feature_id,))
    feature = cur.fetchone()

    if not feature:
        return {
            'allowed': False,
            'limit': None,
            'used': 0,
            'remaining': None,
            'reason': 'feature_not_found'
        }

    # Priority 1: Check user-specific restriction
    cur.execute("""
        SELECT limit_value
        FROM user_feature_restrictions
        WHERE profile_id = %s AND feature_id = %s
    """, (profile_id, feature_id))
    restriction = cur.fetchone()

    if restriction is not None:
        limit = restriction['limit_value']
    else:
        # Priority 2: Check tier limit
        tier_id = get_effective_tier(profile_id, conn)
        cur.execute("""
            SELECT limit_value
            FROM tier_limits
            WHERE tier_id = %s AND feature_id = %s
        """, (tier_id, feature_id))
        tier_limit = cur.fetchone()

        if tier_limit is not None:
            limit = tier_limit['limit_value']
        else:
            # Priority 3: Feature default
            limit = feature['default_limit']

    # For boolean features (limit 0 = disabled, 1 = enabled)
    if feature['limit_type'] == 'boolean':
        allowed = limit == 1
        return {
            'allowed': allowed,
            'limit': limit,
            'used': 0,
            'remaining': None,
            'reason': 'enabled' if allowed else 'feature_disabled'
        }

    # For count-based features
    # Check current usage
    cur.execute("""
        SELECT usage_count, reset_at
        FROM user_feature_usage
        WHERE profile_id = %s AND feature_id = %s
    """, (profile_id, feature_id))
    usage = cur.fetchone()

    used = usage['usage_count'] if usage else 0

    # Check if reset is needed
    if usage and usage['reset_at'] and datetime.now() > usage['reset_at']:
        # Reset usage
        used = 0
        next_reset = _calculate_next_reset(feature['reset_period'])
        cur.execute("""
            UPDATE user_feature_usage
            SET usage_count = 0, reset_at = %s, updated = CURRENT_TIMESTAMP
            WHERE profile_id = %s AND feature_id = %s
        """, (next_reset, profile_id, feature_id))
        conn.commit()

    # NULL limit = unlimited
    if limit is None:
        return {
            'allowed': True,
            'limit': None,
            'used': used,
            'remaining': None,
            'reason': 'unlimited'
        }

    # 0 limit = disabled
    if limit == 0:
        return {
            'allowed': False,
            'limit': 0,
            'used': used,
            'remaining': 0,
            'reason': 'feature_disabled'
        }

    # Check if within limit
    allowed = used < limit
    remaining = limit - used if limit else None

    return {
        'allowed': allowed,
        'limit': limit,
        'used': used,
        'remaining': remaining,
        'reason': 'within_limit' if allowed else 'limit_exceeded'
    }


def increment_feature_usage(profile_id: str, feature_id: str) -> None:
    """
    DEPRECATED für Shinkan — siehe club_features.increment_club_feature_usage.

    Increment usage counter for a feature.

    Creates usage record if it doesn't exist, with reset_at based on
    feature's reset_period.
    """
    with get_db() as conn:
        cur = get_cursor(conn)

        # Get feature reset period
        cur.execute("""
            SELECT reset_period
            FROM features
            WHERE id = %s
        """, (feature_id,))
        feature = cur.fetchone()

        if not feature:
            return

        reset_period = feature['reset_period']
        next_reset = _calculate_next_reset(reset_period)

        # Upsert usage
        cur.execute("""
            INSERT INTO user_feature_usage (profile_id, feature_id, usage_count, reset_at)
            VALUES (%s, %s, 1, %s)
            ON CONFLICT (profile_id, feature_id)
            DO UPDATE SET
                usage_count = user_feature_usage.usage_count + 1,
                updated = CURRENT_TIMESTAMP
        """, (profile_id, feature_id, next_reset))

        conn.commit()


def _calculate_next_reset(reset_period: str) -> Optional[datetime]:
    """
    Calculate next reset timestamp based on reset period.

    Args:
        reset_period: 'never', 'daily', 'monthly'

    Returns:
        datetime or None (for 'never')
    """
    if reset_period == 'never':
        return None
    elif reset_period == 'daily':
        # Reset at midnight
        tomorrow = datetime.now().date() + timedelta(days=1)
        return datetime.combine(tomorrow, datetime.min.time())
    elif reset_period == 'monthly':
        # Reset at start of next month
        now = datetime.now()
        if now.month == 12:
            return datetime(now.year + 1, 1, 1)
        else:
            return datetime(now.year, now.month + 1, 1)
    else:
        return None