"""Admin routes: user provisioning + role management (no self-registration)."""
from __future__ import annotations

from flask import Blueprint, jsonify, request

from ..auth.users import AuthError
from ..config import Config
from .helpers import ApiError, current_user, require_auth, require_roles

admin_bp = Blueprint("admin", __name__)


def _store():
    from flask import current_app

    return current_app.extensions["user_store"]


@admin_bp.post("/users")
@require_auth
@require_roles("admin")
def create_user():
    """Create a user + provision a password (invite). Admin or super-admin only."""
    data = request.get_json(silent=True) or {}
    name = (data.get("name") or "").strip()
    username = (data.get("username") or data.get("email") or "").strip().lower()
    password = data.get("password") or ""
    role = (data.get("role") or "user").strip()
    org_id = (data.get("org_id") or current_user().get("org_id") or "org-default").strip()

    if not username or not password:
        raise ApiError("username and password are required")
    if role not in Config.ROLES:
        raise ApiError(f"invalid role: {role}")
    # Only super_admin can create another admin/super_admin
    actor_role = current_user().get("role")
    if role in ("admin", "super_admin") and actor_role != "super_admin":
        raise ApiError("only super_admin can grant admin roles", 403)
    try:
        user = _store().create_user(
            org_id=org_id, username=username, password=password, name=name, role=role
        )
    except AuthError as exc:
        raise ApiError(str(exc))
    return jsonify({"user": _store().public_user(user)}), 201


@admin_bp.get("/users")
@require_auth
@require_roles("admin")
def list_users():
    actor = current_user()
    if actor.get("role") == "super_admin":
        users = _store().list_users()
    else:
        users = _store().list_users(org_id=actor.get("org_id"))
    return jsonify({"users": users})


@admin_bp.put("/users/<username>")
@require_auth
@require_roles("admin")
def update_user(username: str):
    data = request.get_json(silent=True) or {}
    username = username.strip().lower()
    actor = current_user()
    target = _store().get_user_or_none(username)
    if not target:
        raise ApiError("user not found", 404)

    # Role changes / admin-modification restricted to super_admin
    if "role" in data:
        role = (data.get("role") or "").strip()
        if role not in Config.ROLES:
            raise ApiError(f"invalid role: {role}")
        if actor.get("role") != "super_admin":
            raise ApiError("only super_admin can change roles")
        _store().set_role(username, role)

    if "active" in data:
        if actor.get("role") != "super_admin":
            raise ApiError("only super_admin can activate/deactivate users")
        _store().set_active(username, bool(data.get("active")))

    if "password" in data and data.get("password"):
        _store().set_password(username, data.get("password"))

    if "email" in data:
        try:
            _store().set_email(username, data.get("email"))
        except AuthError as exc:
            raise ApiError(str(exc))

    return jsonify({"user": _store().public_user(_store().get_user(username))})