from fastapi import Depends, HTTPException, Header, status
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
from sqlalchemy.orm import Session
from app.models.database import get_db
from app.models.client import Client
from app.security.auth import verify_api_key, decode_token
from app.config import settings

bearer_scheme = HTTPBearer()


def get_current_client(
    x_api_key: str = Header(alias="X-API-Key"),
    db: Session = Depends(get_db),
) -> Client:
    client = db.query(Client).filter(
        Client.active == True,  # noqa: E712
        Client.deleted_at == None,  # noqa: E711
    ).all()

    for c in client:
        if verify_api_key(x_api_key, c.api_key_hash):
            return c

    raise HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="API Key inválida o cliente inactivo",
    )


def get_jwt_client(
    credentials: HTTPAuthorizationCredentials = Depends(bearer_scheme),
    db: Session = Depends(get_db),
) -> Client:
    payload = decode_token(credentials.credentials)
    client_id = payload.get("sub")

    client = db.query(Client).filter(
        Client.id == client_id,
        Client.active == True,  # noqa: E712
        Client.deleted_at == None,  # noqa: E711
    ).first()

    if not client:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Cliente no encontrado o inactivo",
        )
    return client


def verify_admin(x_admin_secret: str = Header(alias="X-Admin-Secret")) -> bool:
    if x_admin_secret != settings.ADMIN_SECRET:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Admin secret inválido",
        )
    return True