from fastapi import APIRouter, Depends, HTTPException, Query
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select
from typing import List

from app.db.session import get_db
from app.models.models import Finding, AttackPath
from app.schemas.schemas import AttackPathOut
from app.core.security import require_executive_or_above

router = APIRouter(prefix="/attack-paths", tags=["attack-paths"])


@router.get("/{finding_id}", response_model=List[AttackPathOut])
async def get_attack_paths(
    finding_id: str,
    generate: bool = Query(False),
    payload: dict = Depends(require_executive_or_above),
    db: AsyncSession = Depends(get_db),
):
    """Get attack paths for a finding. Optionally auto-generate if missing."""
    # Verify tenant access
    f_result = await db.execute(select(Finding).where(Finding.id == finding_id))
    finding = f_result.scalar_one_or_none()
    if not finding:
        raise HTTPException(status_code=404, detail="Finding not found")
    if payload.get("role") != "trustos_admin" and payload.get("tenant_id") != finding.tenant_id:
        raise HTTPException(status_code=403, detail="Access denied")

    result = await db.execute(select(AttackPath).where(AttackPath.finding_id == finding_id))
    paths = result.scalars().all()

    # Auto-generate if requested and none exist
    if generate and not paths:
        from app.services.ai_translator import generate_attack_path_narrative
        import asyncio
        # Generate in background but return empty list immediately
        asyncio.create_task(generate_attack_path_narrative(finding_id))

    return paths


@router.post("/{finding_id}/generate")
async def generate_attack_path(
    finding_id: str,
    payload: dict = Depends(require_executive_or_above),
    db: AsyncSession = Depends(get_db),
):
    """Trigger AI generation of attack path narrative for a finding."""
    from app.services.ai_translator import generate_attack_path_narrative
    import asyncio
    asyncio.create_task(generate_attack_path_narrative(finding_id))
    return {"status": "queued", "finding_id": finding_id}