# app/models/user.py — rôle stocké comme énumération
import enum
from sqlalchemy import Enum
from sqlalchemy.orm import Mapped, mapped_column


class Role(str, enum.Enum):
    MEMBER = "member"
    EDITOR = "editor"
    ADMIN = "admin"


class User(Base):
    __tablename__ = "users"
    id: Mapped[int] = mapped_column(primary_key=True)
    email: Mapped[str]
    role: Mapped[Role] = mapped_column(Enum(Role), default=Role.MEMBER)

# Dépendance paramétrable pour exiger un rôle minimum
from fastapi import Depends, HTTPException, status
from typing import Annotated


def require_role(minimum_role: Role):
    role_hierarchy = {Role.MEMBER: 0, Role.EDITOR: 1, Role.ADMIN: 2}

    def dependency(current_user: Annotated[User, Depends(get_current_user)]) -> User:
        if role_hierarchy[current_user.role] < role_hierarchy[minimum_role]:
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail=f"Rôle '{minimum_role.value}' requis",
            )
        return current_user

    return dependency


@router.delete("/products/{id}")
def delete_product(
    id: int,
    current_user: Annotated[User, Depends(require_role(Role.ADMIN))],
):
    return {"deleted": id}

# Permissions granulaires (RBAC fin) — au-delà d'une simple hiérarchie de rôles
PERMISSIONS = {
    Role.MEMBER: {"products:read"},
    Role.EDITOR: {"products:read", "products:write"},
    Role.ADMIN: {"products:read", "products:write", "products:delete", "users:manage"},
}


def require_permission(permission: str):
    def dependency(current_user: Annotated[User, Depends(get_current_user)]) -> User:
        if permission not in PERMISSIONS.get(current_user.role, set()):
            raise HTTPException(status_code=403, detail=f"Permission '{permission}' requise")
        return current_user

    return dependency


@router.post("/products")
def create_product(
    data: ProductCreate,
    current_user: Annotated[User, Depends(require_permission("products:write"))],
):
    return {"created": data}

# Ownership check — l'utilisateur ne peut modifier QUE ses propres ressources (sauf admin)
def get_owned_product(
    product_id: int,
    db: Annotated[Session, Depends(get_db)],
    current_user: Annotated[User, Depends(get_current_user)],
) -> Product:
    product = db.get(Product, product_id)
    if not product:
        raise HTTPException(status_code=404, detail="Produit introuvable")

    if product.owner_id != current_user.id and current_user.role != Role.ADMIN:
        raise HTTPException(status_code=403, detail="Vous n'êtes pas propriétaire de cette ressource")

    return product


@router.put("/products/{product_id}")
def update_product(
    product: Annotated[Product, Depends(get_owned_product)],
    data: ProductUpdate,
    db: Annotated[Session, Depends(get_db)],
):
    for key, value in data.model_dump(exclude_unset=True).items():
        setattr(product, key, value)
    db.commit()
    return product

# Row-level security au niveau de la requête — filtrer directement dans la query
def list_my_products(
    db: Annotated[Session, Depends(get_db)],
    current_user: Annotated[User, Depends(get_current_user)],
):
    if current_user.role == Role.ADMIN:
        return db.query(Product).all()  # l'admin voit tout
    return db.query(Product).filter(Product.owner_id == current_user.id).all()