from flask import Blueprint, request, jsonify
from flask_jwt_extended import jwt_required, get_jwt_identity
from app.extensions import db
from app.models.user import User
from app.services.auth_service import AuthService
from app.utils.rbac import admin_required, get_current_user

users_bp = Blueprint('users', __name__, url_prefix='/api/v1/users')

@users_bp.route('', methods=['GET'])
@admin_required()
def list_users():
    users = User.query.order_by(User.criado_em.desc()).all()
    return jsonify([u.to_dict() for u in users]), 200

@users_bp.route('', methods=['POST'])
@admin_required()
def create_user():
    data = request.get_json() or {}
    nome = data.get('nome')
    email = data.get('email')
    password = data.get('password')
    role = data.get('role', 'user')

    res, error = AuthService.create_user(nome, email, password, role)
    if error:
        return jsonify({'error': error}), 400

    return jsonify(res), 201

@users_bp.route('/<user_id>', methods=['GET'])
@jwt_required()
def get_user(user_id):
    current_user = get_current_user()
    if not current_user:
        return jsonify({'error': 'Não autorizado.'}), 401

    if not current_user.is_admin() and current_user.id != user_id:
        return jsonify({'error': 'Acesso negado.'}), 403

    user = db.session.get(User, user_id)
    if not user:
        return jsonify({'error': 'Usuário não encontrado.'}), 404

    return jsonify(user.to_dict()), 200

@users_bp.route('/<user_id>', methods=['PUT'])
@admin_required()
def update_user(user_id):
    user = db.session.get(User, user_id)
    if not user:
        return jsonify({'error': 'Usuário não encontrado.'}), 404

    data = request.get_json() or {}
    if 'nome' in data:
        user.nome = data['nome'].strip()
    if 'role' in data and data['role'] in ('admin', 'user'):
        user.role = data['role']
    if 'ativo' in data:
        user.ativo = bool(data['ativo'])
    if 'new_password' in data and data['new_password']:
        if len(data['new_password']) < 6:
            return jsonify({'error': 'A senha deve conter no mínimo 6 caracteres.'}), 400
        user.set_password(data['new_password'])

    db.session.commit()
    return jsonify(user.to_dict()), 200

@users_bp.route('/<user_id>', methods=['DELETE'])
@admin_required()
def delete_user(user_id):
    current_user = get_current_user()
    if current_user and current_user.id == user_id:
        return jsonify({'error': 'Não é possível excluir o próprio usuário em uso.'}), 400

    user = db.session.get(User, user_id)
    if not user:
        return jsonify({'error': 'Usuário não encontrado.'}), 404

    db.session.delete(user)
    db.session.commit()
    return jsonify({'message': f'Usuário {user.email} excluído com sucesso.'}), 200