"""REST API v1 — 全部路由。"""
import os
from flask import Blueprint, request, jsonify, current_app
from auth import login_required, permission_required
from database import db
from models import Instance, User, AuditLog
from services import user_service, stats_service, backup_service

bp = Blueprint("api", __name__)


# ═══════════════════════════════════════════════════════════════
#  仪表盘
# ═══════════════════════════════════════════════════════════════
@bp.route("/dashboard")
@login_required
def dashboard():
    return jsonify(stats_service.get_dashboard_summary())


@bp.route("/stats/system")
@login_required
def system_stats():
    return jsonify(stats_service.get_realtime_metrics())


@bp.route("/stats/traffic-trend")
@login_required
def traffic_trend():
    days = request.args.get("days", 30, type=int)
    return jsonify(stats_service.get_traffic_trend(days))


@bp.route("/stats/users")
@login_required
def user_ranking():
    return jsonify(stats_service.get_user_stats())


@bp.route("/stats/instances")
@login_required
def instance_ranking():
    return jsonify(stats_service.get_instance_stats())


@bp.route("/stats/connections")
@login_required
def active_connections():
    return jsonify(stats_service.get_active_connections())


# ═══════════════════════════════════════════════════════════════
#  实例管理
# ═══════════════════════════════════════════════════════════════
@bp.route("/instances", methods=["GET"])
@login_required
def list_instances():
    return jsonify(current_app.instance_manager.get_status())


@bp.route("/instances", methods=["POST"])
@login_required
def create_instance():
    data = request.get_json()
    name = data.get("name")
    if not name:
        return {"error": "名称不能为空"}, 400
    if db.session.query(Instance).filter_by(name=name).first():
        return {"error": "名称已存在"}, 400

    inst = Instance(
        name=name,
        listen_host=data.get("listen_host", "0.0.0.0"),
        listen_port=int(data.get("listen_port", 1080)),
        timeout=int(data.get("timeout", 30)),
        auth_method=data.get("auth_method", "none"),
        bandwidth_down=float(data.get("bandwidth_down", 0)),
        bandwidth_up=float(data.get("bandwidth_up", 0)),
        max_concurrent=int(data.get("max_concurrent", 10)),
        notes=data.get("notes", ""),
    )
    db.session.add(inst)
    db.session.commit()

    if data.get("start", True):
        current_app.instance_manager.start_instance(inst.id)

    return jsonify({"id": inst.id}), 201


@bp.route("/instances/<int:iid>", methods=["PUT"])
@login_required
def update_instance(iid):
    inst = db.session.query(Instance).get(iid)
    if not inst:
        return {"error": "实例不存在"}, 404
    data = request.get_json()
    for k in ("listen_host", "listen_port", "timeout", "auth_method",
              "bandwidth_down", "bandwidth_up", "max_concurrent", "notes"):
        v = data.get(k)
        if v is not None:
            setattr(inst, k, float(v) if k in ("bandwidth_down", "bandwidth_up")
                    else int(v) if k in ("listen_port", "timeout", "max_concurrent")
                    else v)
    db.session.commit()

    # 重启以应用配置
    if inst.running:
        try:
            current_app.instance_manager.restart_instance(iid)
        except OSError as e:
            return {"error": f"重启失败（端口可能被占用）: {e}"}, 500

    return {"ok": True}


@bp.route("/instances/<int:iid>", methods=["DELETE"])
@login_required
def delete_instance(iid):
    inst = db.session.query(Instance).get(iid)
    if not inst:
        return {"error": "实例不存在"}, 404
    current_app.instance_manager.stop_instance(iid)
    db.session.delete(inst)
    db.session.commit()
    return jsonify({"ok": True})


@bp.route("/instances/<int:iid>/start", methods=["POST"])
@login_required
def start_instance(iid):
    try:
        ok = current_app.instance_manager.start_instance(iid)
        if not ok:
            return {"error": "启动失败"}, 500
        return {"ok": True}
    except OSError as e:
        return {"error": f"启动失败: {e}"}, 500


@bp.route("/instances/<int:iid>/stop", methods=["POST"])
@login_required
def stop_instance(iid):
    if current_app.instance_manager.stop_instance(iid):
        return {"ok": True}
    return {"error": "停止失败"}, 500


@bp.route("/instances/<int:iid>/restart", methods=["POST"])
@login_required
def restart_instance(iid):
    try:
        ok = current_app.instance_manager.restart_instance(iid)
        if not ok:
            return {"error": "重启失败"}, 500
        return {"ok": True}
    except OSError as e:
        return {"error": f"重启失败: {e}"}, 500


@bp.route("/instances/sync", methods=["POST"])
@login_required
def sync_instances():
    current_app.instance_manager.sync_instances()
    return jsonify({"ok": True})


# ═══════════════════════════════════════════════════════════════
#  用户管理
# ═══════════════════════════════════════════════════════════════
@bp.route("/users", methods=["GET"])
@login_required
def list_users():
    page = request.args.get("page", 1, type=int)
    search = request.args.get("search", "")
    return jsonify(current_app.user_service.list_users(page=page, search=search))


@bp.route("/users", methods=["POST"])
@login_required
def create_user():
    data = request.get_json()
    result = current_app.user_service.create_user(
        username=data.get("username", ""),
        password=data.get("password", ""),
        bandwidth_down=float(data.get("bandwidth_down", 0)),
        bandwidth_up=float(data.get("bandwidth_up", 0)),
        max_concurrent=int(data.get("max_concurrent", 10)),
        total_traffic_mb=float(data.get("total_traffic_mb", 0)),
        monthly_traffic_mb=float(data.get("monthly_traffic_mb", 0)),
        ip_whitelist=data.get("ip_whitelist", ""),
        ip_blacklist=data.get("ip_blacklist", ""),
        expire_at=data.get("expire_at"),
    )
    if "error" in result:
        return jsonify(result), 400
    return jsonify(result), 201


@bp.route("/users/<int:uid>", methods=["PUT"])
@login_required
def update_user(uid):
    data = request.get_json()
    result = current_app.user_service.update_user(uid, **data)
    if "error" in result:
        return jsonify(result), 404
    return jsonify(result)


@bp.route("/users/<int:uid>", methods=["DELETE"])
@login_required
def delete_user(uid):
    result = current_app.user_service.delete_user(uid)
    if "error" in result:
        return jsonify(result), 404
    return jsonify(result)


@bp.route("/users/<int:uid>/toggle", methods=["POST"])
@login_required
def toggle_user(uid):
    enabled = request.json.get("enabled", False) if request.is_json else True
    return jsonify(current_app.user_service.toggle_user(uid, enabled))


@bp.route("/users/<int:uid>/ban", methods=["POST"])
@login_required
def ban_user(uid):
    banned = request.json.get("banned", True) if request.is_json else True
    return jsonify(current_app.user_service.ban_user(uid, banned))


# ═══════════════════════════════════════════════════════════════
#  审计日志
# ═══════════════════════════════════════════════════════════════
@bp.route("/logs", methods=["GET"])
@login_required
def query_logs():
    page = request.args.get("page", 1, type=int)
    return jsonify(current_app.user_service.query_logs(
        page=page,
        event=request.args.get("event", ""),
        user=request.args.get("user", ""),
        src_ip=request.args.get("src_ip", ""),
    ))


# ═══════════════════════════════════════════════════════════════
#  备份
# ═══════════════════════════════════════════════════════════════
@bp.route("/backups", methods=["GET"])
@login_required
def list_backups():
    return jsonify(backup_service.list_backups())


@bp.route("/backups", methods=["POST"])
@login_required
def create_backup():
    note = request.get_json().get("note", "") if request.is_json else ""
    result = backup_service.create_backup(note=note)
    if "error" in result:
        return jsonify(result), 500
    return jsonify(result), 201


@bp.route("/backups/<int:bid>/restore", methods=["POST"])
@login_required
def restore_backup(bid):
    result = backup_service.restore_backup(bid)
    if "error" in result:
        return jsonify(result), 500
    return jsonify(result)


@bp.route("/backups/cleanup", methods=["POST"])
@login_required
def cleanup_backups():
    keep = request.json.get("keep", 10) if request.is_json else 10
    backup_service.cleanup_old_backups(keep=int(keep))
    return jsonify({"ok": True})


# ═══════════════════════════════════════════════════════════════
#  后台管理员账户
# ═══════════════════════════════════════════════════════════════
def _serialize_admin(a):
    return {
        "id": a.id,
        "username": a.username,
        "role": a.role,
        "role_label": a.role_label,
        "enabled": a.enabled,
        "last_login_at": a.last_login_at.isoformat() if a.last_login_at else None,
        "last_login_ip": a.last_login_ip,
        "created_at": a.created_at.isoformat() if a.created_at else None,
    }


@bp.route("/admins")
@login_required
@permission_required("admins:read")
def list_admins():
    from models import AdminUser
    admins = AdminUser.query.order_by(AdminUser.id.asc()).all()
    return jsonify([_serialize_admin(a) for a in admins])


@bp.route("/admins", methods=["POST"])
@login_required
@permission_required("admins:write")
def create_admin():
    from models import AdminUser
    data = request.get_json(silent=True) or {}
    username = (data.get("username") or "").strip()
    password = data.get("password") or ""
    role = data.get("role", "viewer")
    if not username or not password:
        return jsonify({"error": "用户名和密码不能为空"}), 400
    if len(password) < 4:
        return jsonify({"error": "密码至少 4 位"}), 400
    if role not in AdminUser.ROLE_LABELS:
        role = "viewer"
    if AdminUser.query.filter_by(username=username).first():
        return jsonify({"error": "用户名已存在"}), 409
    admin = AdminUser()
    admin.username = username
    admin.role = role
    admin.enabled = True
    admin.set_password(password)
    db.session.add(admin)
    db.session.commit()
    return jsonify(_serialize_admin(admin)), 201


@bp.route("/admins/<int:aid>", methods=["DELETE"])
@login_required
@permission_required("admins:write")
def delete_admin_api(aid):
    from models import AdminUser
    from auth import current_admin
    admin = AdminUser.query.get_or_404(aid)
    curr = current_admin()
    if curr and curr.id == admin.id:
        return jsonify({"error": "不能删除当前登录账户"}), 400
    if admin.role == "superadmin":
        super_count = AdminUser.query.filter_by(role="superadmin", enabled=True).count()
        if super_count <= 1:
            return jsonify({"error": "至少需要保留一个启用的超级管理员"}), 400
    db.session.delete(admin)
    db.session.commit()
    return jsonify({"ok": True, "deleted": admin.username})


@bp.route("/admins/<int:aid>", methods=["PUT"])
@login_required
@permission_required("admins:write")
def update_admin_api(aid):
    from models import AdminUser
    admin = AdminUser.query.get_or_404(aid)
    data = request.get_json(silent=True) or {}
    # 角色更新
    role = data.get("role")
    if role:
        if role not in AdminUser.ROLE_LABELS:
            return jsonify({"error": "无效的角色"}), 400
        admin.role = role
    # 密码更新
    password = data.get("password")
    if password:
        if len(password) < 4:
            return jsonify({"error": "密码至少 4 位"}), 400
        admin.set_password(password)
    # 启停
    if "enabled" in data:
        enabled = bool(data["enabled"])
        from auth import current_admin
        curr = current_admin()
        if curr and curr.id == admin.id and not enabled:
            return jsonify({"error": "不能禁用当前登录账户"}), 400
        admin.enabled = enabled
    db.session.commit()
    return jsonify(_serialize_admin(admin))