from fastapi import APIRouter, Depends, HTTPException, Query
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select
from typing import List

from app.db.session import get_db
from app.models.models import Finding, Executive, AuthorizedAsset
from app.schemas.schemas import AuthorizedAssetCreate, AuthorizedAssetOut
from app.core.security import require_admin, require_it_or_above

router = APIRouter(prefix="/footprint", tags=["footprint"])


@router.get("/{tenant_id}")
async def get_footprint(
    tenant_id: str,
    payload: dict = Depends(require_it_or_above),
    db: AsyncSession = Depends(get_db),
):
    if payload.get("role") != "trustos_admin" and payload.get("tenant_id") != tenant_id:
        raise HTTPException(status_code=403, detail="Access denied")

    # Digital footprint findings
    from app.models.models import FindingCategory
    fp_result = await db.execute(
        select(Finding).where(
            Finding.tenant_id == tenant_id,
            Finding.category == FindingCategory.digital_footprint
        )
    )
    footprint_findings = fp_result.scalars().all()

    # Executives
    exec_result = await db.execute(
        select(Executive).where(Executive.tenant_id == tenant_id, Executive.is_enrolled == True)
    )
    executives = exec_result.scalars().all()

    return {
        "tenant_id": tenant_id,
        "executives": [
            {"id": e.id, "name": e.full_name, "title": e.title, "email": e.corporate_email}
            for e in executives
        ],
        "footprint_findings": [
            {
                "id": f.id,
                "title": f.title,
                "severity": f.severity.value,
                "ai_summary": f.ai_summary,
                "status": f.status.value,
                "source": f.source,
            }
            for f in footprint_findings
        ],
        "total_exposures": len(footprint_findings),
    }


@router.get("/authorized-assets/{tenant_id}", response_model=List[AuthorizedAssetOut])
async def list_authorized_assets(
    tenant_id: str,
    payload: dict = Depends(require_it_or_above),
    db: AsyncSession = Depends(get_db),
):
    if payload.get("role") != "trustos_admin" and payload.get("tenant_id") != tenant_id:
        raise HTTPException(status_code=403, detail="Access denied")
    result = await db.execute(
        select(AuthorizedAsset).where(
            AuthorizedAsset.tenant_id == tenant_id,
            AuthorizedAsset.is_active == True
        )
    )
    return result.scalars().all()


@router.post("/authorized-assets/{tenant_id}", response_model=AuthorizedAssetOut, status_code=201)
async def add_authorized_asset(
    tenant_id: str,
    body: AuthorizedAssetCreate,
    payload: dict = Depends(require_admin),
    db: AsyncSession = Depends(get_db),
):
    asset = AuthorizedAsset(tenant_id=tenant_id, **body.model_dump())
    db.add(asset)
    await db.commit()
    await db.refresh(asset)
    return asset