"""The Auth tab — status, the access matrix, sync, and cross-app lookups.

Everything here is either read-only visibility or a re-push of display-only
reports; nothing grants access anywhere.
"""

from fastapi import APIRouter, Depends, HTTPException, status

from app.models.account import Account
from app.models.schemas import AccessMatrix, BWStatus, CrossAppAccess, MatrixUser
from app.services import accounts as accounts_service
from app.services import levels
from app.services.authz import require_accounts_admin
from app.db import get_db
from sqlalchemy.orm import Session

router = APIRouter(prefix="/api/auth", tags=["auth-admin"])


@router.get("/status", response_model=BWStatus)
def bw_status(_account: Account = Depends(require_accounts_admin)) -> BWStatus:
    return BWStatus(**levels.bw_status())


@router.post("/sync", status_code=status.HTTP_202_ACCEPTED)
def sync_now(_account: Account = Depends(require_accounts_admin)) -> dict:
    """Re-push the project catalog and every member's access to central
    visibility. Idempotent; display-only on the other side."""
    if not levels.bw_status()["configured"]:
        raise HTTPException(
            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
            detail={
                "error_code": "BW_AUTH_NOT_CONFIGURED",
                "summary": "BW Auth is not configured for this app.",
            },
        )
    levels.sync_all()
    levels.report_project_catalog()
    return {"synced": True}


@router.get("/matrix", response_model=AccessMatrix)
def access_matrix(
    _account: Account = Depends(require_accounts_admin), db: Session = Depends(get_db)
) -> AccessMatrix:
    """Every user × every project, with the EFFECTIVE level in each cell —
    resolved exactly the way requests are, so this is the truth at a glance."""
    matrix = levels.access_matrix()
    display = {a.username: a.display_name for a in accounts_service.list_all(db)}
    active = {a.username: a.active for a in accounts_service.list_all(db)}
    users = [
        MatrixUser(
            username=row["username"],
            display_name=display.get(row["username"], row["username"]),
            level=row["level"],
            all_instances=row["all_instances"],
            active=active.get(row["username"], True),
            cells=row["cells"],
        )
        for row in matrix["users"]
    ]
    return AccessMatrix(projects=matrix["projects"], users=users)


@router.get("/users/{username}/apps", response_model=list[CrossAppAccess])
def cross_app_access(
    username: str, _account: Account = Depends(require_accounts_admin)
) -> list[CrossAppAccess]:
    """Where else this person has BW-app access, per every app's own reports.
    Server-scoped to users Scout has reported."""
    try:
        entries = levels.cross_app_access(username.strip().lower())
    except levels.BWAuthError as exc:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail={
                "error_code": "BW_LOOKUP_FAILED",
                "summary": "Central lookup failed for that user.",
                "details": str(exc),
            },
        ) from exc
    return [CrossAppAccess(**{k: v for k, v in e.items() if k in CrossAppAccess.model_fields})
            for e in entries]