"""Auth routes — login, register, logout."""
from datetime import datetime
from flask import Blueprint, render_template, redirect, url_for, request, flash, session, make_response
from flask_login import login_user, logout_user, login_required, current_user
from app.extensions import db
from app.models.user import User
from app.models.admin import Admin

auth_bp = Blueprint('auth', __name__, template_folder='../../templates/auth')


@auth_bp.route('/login', methods=['GET', 'POST'])
def login():
    """User login page."""
    if current_user.is_authenticated:
        return redirect(url_for('dashboard.index'))

    error = None
    if request.method == 'POST':
        login_id = request.form.get('login_id', '').strip()
        password = request.form.get('password', '')

        # Coba cari di tabel users (by email or username)
        user = User.query.filter(
            (User.email == login_id) | (User.username == login_id)
        ).first()

        if user and user.check_password(password):
            if not user.is_active:
                error = 'Akun Anda telah dinonaktifkan. Hubungi administrator.'
            elif not user.is_approved:
                return redirect(url_for('auth.pending_approval'))
            else:
                user.last_login = datetime.utcnow()
                db.session.commit()
                login_user(user, remember=True)
                # Restore user preferences to session
                from app.models.user_settings import UserSettings
                saved_mode = UserSettings.get(user.id, 'asset_mode', 'stock')
                saved_color = UserSettings.get(user.id, 'color_mode', 'dark')
                session['asset_mode'] = saved_mode
                session['color_mode'] = saved_color
                next_page = request.args.get('next')
                # Hindari redirect ke logout setelah login (loop)
                if next_page and 'logout' in next_page:
                    next_page = None
                return redirect(next_page or url_for('dashboard.index'))
        else:
            error = 'Email/username atau password salah.'

    return render_template('auth/login.html', error=error)


@auth_bp.route('/admin/login', methods=['GET', 'POST'])
def admin_login():
    """Admin login page — separate from user login."""
    if current_user.is_authenticated:
        from app.helpers.auth import is_admin
        if is_admin():
            return redirect(url_for('dashboard.index'))
        # User biasa → redirect ke dashboard user
        return redirect(url_for('dashboard.index'))

    error = None
    if request.method == 'POST':
        login_id = request.form.get('login_id', '').strip()
        password = request.form.get('password', '')

        admin = Admin.query.filter(
            (Admin.email == login_id) | (Admin.username == login_id)
        ).first()

        if admin and admin.check_password(password):
            admin.last_login = datetime.utcnow()
            db.session.commit()
            login_user(admin, remember=True)
            session['asset_mode'] = session.get('asset_mode', 'stock')
            session['color_mode'] = session.get('color_mode', 'dark')
            return redirect(url_for('dashboard.index'))
        else:
            error = 'Username/email atau password salah.'

    return render_template('admin/login.html', error=error)


@auth_bp.route('/register', methods=['GET', 'POST'])
def register():
    """Self-registration — user perlu approval admin."""
    if current_user.is_authenticated:
        return redirect(url_for('dashboard.index'))

    error = None
    if request.method == 'POST':
        username = request.form.get('username', '').strip()
        email = request.form.get('email', '').strip().lower()
        password = request.form.get('password', '')
        confirm = request.form.get('confirm_password', '')

        # Validasi
        if not username or not email or not password:
            error = 'Semua field harus diisi.'
        elif len(username) < 3:
            error = 'Username minimal 3 karakter.'
        elif len(password) < 6:
            error = 'Password minimal 6 karakter.'
        elif password != confirm:
            error = 'Password dan konfirmasi tidak cocok.'
        elif User.query.filter_by(username=username).first():
            error = 'Username sudah digunakan.'
        elif User.query.filter_by(email=email).first():
            error = 'Email sudah terdaftar.'
        else:
            user = User(
                username=username,
                email=email,
                is_approved=False,
                is_active=True,
            )
            user.set_password(password)
            db.session.add(user)
            db.session.commit()
            return redirect(url_for('auth.pending_approval'))

    return render_template('auth/register.html', error=error)


@auth_bp.route('/pending-approval')
def pending_approval():
    """Info page: menunggu admin approval."""
    return render_template('auth/pending_approval.html')


@auth_bp.route('/logout')
def logout():
    """Logout dan redirect ke login."""
    if current_user.is_authenticated:
        logout_user()
    session.clear()
    resp = make_response(redirect(url_for('auth.login')))
    # Hapus remember_token cookie secara eksplisit
    resp.delete_cookie('remember_token')
    resp.delete_cookie('session')
    return resp