from __future__ import annotations

from fastapi import APIRouter, Request
from fastapi.responses import RedirectResponse

from app.core.db.common import CommonSessionLocal
from app.core.http_responses import ui_access_denied
from app.core.security.csrf import get_or_create_csrf_token
from app.core.security.session_auth import get_current_user
from app.core.templating import templates
from app.modules.core.rbac.deps import get_user_permissions, get_user_roles
from app.modules.unified_reports.service import (
    can_access_reports,
    cards_by_group,
    get_report_summary,
    get_report_tabs,
    get_visible_report_cards,
)

router = APIRouter(prefix="/reports", tags=["unified-reports-ui"])

_ALLOWED_TABS = {
    "my-reports": "my",
    "work": "work",
    "client": "client",
    "billing": "billing",
    "hr": "hr",
    "system": "system",
    "audit": "audit",
}


def _login_redirect() -> RedirectResponse:
    return RedirectResponse(url="/login", status_code=303)


def _current_user_or_response(request: Request, db):
    current_user = get_current_user(request, db=db)
    if not current_user:
        return None, _login_redirect()
    roles = get_user_roles(db, current_user.id)
    permissions = get_user_permissions(db, current_user.id)
    if not can_access_reports(roles, permissions):
        return None, ui_access_denied()
    return current_user, None


def _payload(db, current_user):
    roles = get_user_roles(db, current_user.id)
    permissions = get_user_permissions(db, current_user.id)
    cards = get_visible_report_cards(roles, permissions)
    groups = cards_by_group(cards)
    return {
        "current_user_roles": roles,
        "current_user_permissions": permissions,
        "report_cards": cards,
        "report_groups": groups,
        "report_tabs": get_report_tabs(cards),
        "report_summary": get_report_summary(cards),
    }


def _base_context(request: Request, db, current_user, **extra):
    ctx = {
        "request": request,
        "current_user": current_user,
        "csrf_token": get_or_create_csrf_token(request),
    }
    ctx.update(_payload(db, current_user))
    ctx.update(extra)
    return ctx


@router.get("")
def reports_home(request: Request, tab: str = "my-reports"):
    db = CommonSessionLocal()
    try:
        current_user, response = _current_user_or_response(request, db)
        if response:
            return response
        active_tab = tab if tab in _ALLOWED_TABS else "my-reports"
        return templates.TemplateResponse(
            "modules/unified_reports/templates/unified_reports/dashboard.html",
            _base_context(request, db, current_user, title="Reports Centre", active_tab=active_tab),
        )
    finally:
        db.close()


@router.get("/tab/{tab_name}")
def reports_tab(request: Request, tab_name: str):
    db = CommonSessionLocal()
    try:
        current_user, response = _current_user_or_response(request, db)
        if response:
            return response
        active_tab = tab_name if tab_name in _ALLOWED_TABS else "my-reports"
        group_key = _ALLOWED_TABS[active_tab]
        return templates.TemplateResponse(
            f"modules/unified_reports/templates/unified_reports/partials/{active_tab.replace('-', '_')}.html",
            _base_context(
                request,
                db,
                current_user,
                title="Reports Centre",
                active_tab=active_tab,
                active_group=group_key,
                active_cards=cards_by_group(get_visible_report_cards(get_user_roles(db, current_user.id), get_user_permissions(db, current_user.id))).get(group_key, []),
            ),
        )
    finally:
        db.close()