from flask import Blueprint, request, jsonify
from flask_jwt_extended import jwt_required, get_jwt_identity, create_access_token
from app.services.auth_service import AuthService
from app.utils.rbac import get_current_user

auth_bp = Blueprint('auth', __name__, url_prefix='/api/v1/auth')

@auth_bp.route('/login', methods=['POST'])
def login():
    data = request.get_json() or {}
    email = data.get('email')
    password = data.get('password')

    res, error = AuthService.login(email, password)
    if error:
        return jsonify({'error': error}), 401

    return jsonify(res), 200

@auth_bp.route('/refresh', methods=['POST'])
@jwt_required(refresh=True)
def refresh():
    current_user_id = get_jwt_identity()
    user = get_current_user()
    if not user or not user.ativo:
        return jsonify({'error': 'Usuário inativo ou inexistente.'}), 401

    new_access_token = create_access_token(
        identity=current_user_id,
        additional_claims={'role': user.role, 'nome': user.nome}
    )
    return jsonify({'access_token': new_access_token}), 200

@auth_bp.route('/me', methods=['GET'])
@jwt_required()
def me():
    user = get_current_user()
    if not user:
        return jsonify({'error': 'Usuário não encontrado.'}), 404
    return jsonify(user.to_dict()), 200

@auth_bp.route('/change-password', methods=['POST'])
@jwt_required()
def change_password():
    current_user_id = get_jwt_identity()
    data = request.get_json() or {}
    old_password = data.get('old_password')
    new_password = data.get('new_password')

    if not old_password or not new_password:
        return jsonify({'error': 'É necessário informar a senha atual e a nova senha.'}), 400

    success, message = AuthService.change_password(current_user_id, old_password, new_password)
    if not success:
        return jsonify({'error': message}), 400

    return jsonify({'message': message}), 200