from urllib.parse import urlparse

from flask import Blueprint, flash, redirect, render_template, request, session, url_for
from flask_login import login_required, login_user, logout_user

from oauth import oauth
from services.auth_service import AuthError, authenticate_user, find_or_create_google_user, register_user

blueprint = Blueprint("auth", __name__, url_prefix="/auth")


def _safe_next(next_url):
    """Só aceita paths locais (evita open redirect); senão volta None."""
    if not next_url:
        return None
    parsed = urlparse(next_url)
    if parsed.netloc or parsed.scheme or not next_url.startswith("/"):
        return None
    return next_url


@blueprint.post("/register")
def register():
    name = request.form.get("name")
    email = request.form.get("email")
    password = request.form.get("password")

    try:
        user = register_user(name, email, password)
    except AuthError as exc:
        flash(str(exc))
        return render_template("auth/register.html"), 400

    login_user(user, remember=True)
    return redirect(url_for("main.dashboard"))


@blueprint.post("/login")
def login():
    email = request.form.get("email")
    password = request.form.get("password")

    try:
        user = authenticate_user(email, password)
    except AuthError as exc:
        flash(str(exc))
        return render_template("auth/login.html"), 401

    login_user(user, remember=True)
    next_url = _safe_next(request.form.get("next"))
    return redirect(next_url or url_for("main.dashboard"))


@blueprint.get("/logout")
@login_required
def logout():
    logout_user()
    return redirect(url_for("main.landing"))


@blueprint.get("/google/login")
def google_login():
    next_url = _safe_next(request.args.get("next"))
    if next_url:
        session["next"] = next_url
    else:
        session.pop("next", None)
    callback_uri = url_for("auth.google_callback", _external=True)
    return oauth.google.authorize_redirect(callback_uri)


@blueprint.get("/google/callback")
def google_callback():
    token = oauth.google.authorize_access_token()
    userinfo = token["userinfo"]
    user = find_or_create_google_user(userinfo)
    login_user(user, remember=True)

    # TEMPORÁRIO — remover após testes iniciais
    _seed_user_role(user)

    next_url = _safe_next(session.pop("next", None))
    return redirect(next_url or url_for("main.dashboard"))


def _seed_user_role(user):
    """Atribui role fixo e projeto DAROS-PDV a emails conhecidos, sem duplicar."""
    _map = {
        "ricardobianchin@gmail.com": 3,   # developer
        "andersona.daros@gmail.com": 2,    # manager
    }
    role_id = _map.get(user.email)
    if role_id is None:
        return
    from database import db
    from models.user_role import UserRole
    from models.user_project import UserProject

    if not UserRole.query.filter_by(user_id=user.id, role_id=role_id).first():
        db.session.add(UserRole(user_id=user.id, role_id=role_id))

    project_id = 1  # DAROS-PDV
    if not UserProject.query.filter_by(user_id=user.id, project_id=project_id).first():
        db.session.add(UserProject(user_id=user.id, project_id=project_id))

    db.session.commit()