# app/api/admin.py
from fastapi import APIRouter, Depends, HTTPException
from pydantic import BaseModel
from app.core.auth import require_admin_key
from app.core.config import settings
from app.models.schemas import CreateKeyRequest, CreateKeyResponse, KeyInfo
from app.db import database as db

router = APIRouter(prefix="/admin", tags=["Admin"])


@router.post("/keys", response_model=CreateKeyResponse)
async def create_key(
    req: CreateKeyRequest,
    _: bool = Depends(require_admin_key),
):
    """Create a new API key for a client."""
    key = db.create_key(req.client_name)
    return CreateKeyResponse(
        api_key=key,
        client_name=req.client_name,
        message=f"Give this key to '{req.client_name}'. It won't be shown again.",
    )


@router.get("/keys", response_model=list[KeyInfo])
async def list_keys(_: bool = Depends(require_admin_key)):
    """List all API keys."""
    return db.list_keys()


@router.delete("/keys/{api_key}")
async def revoke_key(
    api_key: str,
    _: bool = Depends(require_admin_key),
):
    """Deactivate an API key."""
    if not db.revoke_key(api_key):
        raise HTTPException(status_code=404, detail="Key not found.")
    return {"status": "revoked", "key": api_key}


class CreateUserRequest(BaseModel):
    username: str
    password: str
    admin_key: str | None = None

@router.post("/users")
async def create_user(
    req: CreateUserRequest,
    _: bool = Depends(require_admin_key),
):
    role = "admin" if req.admin_key == settings.ADMIN_KEY else "user"
    success = db.create_user(req.username, req.password, role)
    if not success:
        raise HTTPException(status_code=409, detail="Username already exists.")
    return {"username": req.username, "role": role, "message": f"User '{req.username}' created as {role}."}

@router.get("/users")
async def list_users(_: bool = Depends(require_admin_key)):
    return db.list_users()