"""Admin-only (rian): create manager/client users and forms, invites, view-as list."""

from __future__ import annotations

from fastapi import APIRouter, Form, HTTPException, Request
from fastapi.responses import RedirectResponse

import auth
import deps
import services
from db import query

router = APIRouter()


def _render_admin(request: Request, user, *, new_link: str | None = None,
                  invited: bool = False, error: str | None = None):
    clients = query("SELECT * FROM clients ORDER BY "
                    "CASE role WHEN 'admin' THEN 0 WHEN 'manager' THEN 1 ELSE 2 END, created_at")
    forms = query(
        "SELECT f.*, c.name AS client_name FROM forms f "
        "LEFT JOIN clients c ON c.id = f.created_by ORDER BY f.created_at DESC")
    return deps.render("admin.html", user=user, csrf=request.state.csrf,
                       clients=clients, forms=forms, new_link=new_link, invited=invited,
                       error=error)


@router.get("/admin")
def admin_home(request: Request):
    user = deps.require_admin(request)
    return _render_admin(request, user)


@router.post("/admin/users")
def create_user(request: Request, name: str = Form(...), email: str = Form(...),
                role: str = Form("client"), send_invite: str = Form(""), csrf: str = Form("")):
    user = deps.require_admin(request)
    if not auth.csrf_ok(request.cookies.get(auth.CSRF_COOKIE), csrf):
        raise HTTPException(status_code=403, detail="Bad CSRF token")
    if role not in ("manager", "client"):
        role = "client"
    try:
        cid = services.create_user(name=name, email=email, role=role)
    except ValueError as e:
        return _render_admin(request, user, error=str(e))
    emailed = bool(send_invite)
    link = services.invite(cid, send_email=emailed)
    return _render_admin(request, user, new_link=link, invited=emailed)


@router.post("/admin/clients/{client_id}/relink")
def relink_client(client_id: int, request: Request, csrf: str = Form("")):
    user = deps.require_admin(request)
    if not auth.csrf_ok(request.cookies.get(auth.CSRF_COOKIE), csrf):
        raise HTTPException(status_code=403, detail="Bad CSRF token")
    try:
        link = services.invite(client_id, send_email=True)
    except ValueError:
        raise HTTPException(status_code=404)
    return _render_admin(request, user, new_link=link)


@router.post("/admin/users/{client_id}/delete")
def delete_user(client_id: int, request: Request, csrf: str = Form("")):
    user = deps.require_admin(request)
    if not auth.csrf_ok(request.cookies.get(auth.CSRF_COOKIE), csrf):
        raise HTTPException(status_code=403, detail="Bad CSRF token")
    try:
        services.delete_user(client_id, acting_admin_id=user.id)
    except ValueError as e:
        return _render_admin(request, user, error=str(e))
    return RedirectResponse("/admin", status_code=303)


@router.post("/admin/forms")
def create_form(request: Request, name: str = Form(...), notify_recipients: str = Form(""),
                client_id: str = Form(""), redirect_url: str = Form(""), csrf: str = Form("")):
    user = deps.require_admin(request)
    if not auth.csrf_ok(request.cookies.get(auth.CSRF_COOKIE), csrf):
        raise HTTPException(status_code=403, detail="Bad CSRF token")
    cid = int(client_id) if client_id.strip().isdigit() else None
    try:
        created = services.create_form(
            name=name, creator_id=user.id, notify_recipients=notify_recipients,
            redirect_url=redirect_url, client_id=cid)
    except ValueError as e:
        return _render_admin(request, user, error=str(e))
    return RedirectResponse(f"/forms/{created['id']}/integration", status_code=303)