"""User CRUD-endpoints med roll-baserad åtkomst."""
from typing import Optional
from uuid import UUID

from fastapi import APIRouter, Depends, Query
from sqlalchemy.ext.asyncio import AsyncSession

from app.database import get_db
from app.dependencies import get_current_user, require_admin, require_manager
from app.models import User, UserRole, UserStatus
from app.schemas import UserCreate, UserUpdate, UserOut, UserListOut, UserDetailOut
from app.services.user_service import UserService

router = APIRouter(prefix="/users", tags=["Users"])


@router.get("", response_model=UserListOut)
async def list_users(
    tenant_id: Optional[UUID] = Query(None),
    role: Optional[UserRole] = Query(None),
    status: Optional[UserStatus] = Query(None),
    skip: int = Query(0, ge=0),
    limit: int = Query(100, ge=1, le=500),
    current_user: User = Depends(require_manager),
    db: AsyncSession = Depends(get_db),
):
    service = UserService(db)
    # Managers ser bara användare inom sin tenant (om de inte är superuser)
    effective_tenant = tenant_id
    if not current_user.is_superuser and current_user.role == UserRole.MANAGER:
        effective_tenant = current_user.tenant_id

    items, total = await service.list_users(
        tenant_id=effective_tenant,
        role=role,
        status=status,
        skip=skip,
        limit=limit,
    )
    return UserListOut(items=items, total=total)


@router.get("/{user_id}", response_model=UserDetailOut)
async def get_user(
    user_id: UUID,
    current_user: User = Depends(get_current_user),
    db: AsyncSession = Depends(get_db),
):
    service = UserService(db)
    user = await service.get_by_id(user_id)
    if user is None:
        raise HTTPException(status_code=404, detail="User not found")

    # Managers kan bara se användare inom sin tenant
    if not current_user.is_superuser and current_user.role == UserRole.MANAGER:
        if user.tenant_id != current_user.tenant_id:
            raise HTTPException(status_code=403, detail="Access denied")

    return UserDetailOut.model_validate(user)


@router.post("", response_model=UserOut, status_code=201)
async def create_user(
    data: UserCreate,
    current_user: User = Depends(require_admin),
    db: AsyncSession = Depends(get_db),
):
    service = UserService(db)
    user = await service.create_user(data, created_by=current_user)
    return UserOut.model_validate(user)


@router.patch("/{user_id}", response_model=UserOut)
async def update_user(
    user_id: UUID,
    data: UserUpdate,
    current_user: User = Depends(get_current_user),
    db: AsyncSession = Depends(get_db),
):
    service = UserService(db)
    user = await service.update_user(user_id, data, actor=current_user)
    return UserOut.model_validate(user)


@router.delete("/{user_id}", status_code=204)
async def delete_user(
    user_id: UUID,
    current_user: User = Depends(require_admin),
    db: AsyncSession = Depends(get_db),
):
    service = UserService(db)
    await service.delete_user(user_id, actor=current_user)
    return None


from fastapi import HTTPException