"""账号管理路由"""

import re
import csv
from fastapi import APIRouter, Depends, HTTPException, Query
from sqlalchemy.orm import Session

from ..database import get_db
from ..models import User, Account, AuditLog
from ..schemas import AccountImport, AccountAssign, AccountOut
from ..deps import get_current_user, require_permission
from ..permissions import has_permission

router = APIRouter(prefix="/api/accounts", tags=["账号管理"])

EMAIL_PATTERN = re.compile(r'^[^\s@|]+@[^\s@|]+\.[^\s@|]+$')


def _split_account_line(line: str) -> list[str]:
    if '|' in line:
        return line.split('|')
    if '\t' in line:
        return line.split('\t')
    if ',' in line:
        return next(csv.reader([line]))
    return line.split()


@router.get("", response_model=list[AccountOut])
def list_accounts(
    assigned_only: bool = Query(False),
    db: Session = Depends(get_db),
    current: User = Depends(get_current_user),
):
    """列表：按角色返回不同字段和范围。"""
    query = db.query(Account)

    # 权限控制：客服只能看分配给自己的
    if not has_permission(current.role, "account:view_all"):
        if has_permission(current.role, "account:view_assigned"):
            query = query.filter(Account.assigned_to == current.id)
        else:
            raise HTTPException(status_code=403, detail="无权查看账号")

    if assigned_only and has_permission(current.role, "account:view_all"):
        query = query.filter(Account.assigned_to.isnot(None))

    accounts = query.order_by(Account.id).all()
    result = []
    for acc in accounts:
        item = AccountOut(
            id=acc.id, username=acc.username, remark=acc.remark or "",
            assigned_to=acc.assigned_to,
            assigned_username=acc.assigned_user.username if acc.assigned_user else None,
            created_at=acc.created_at,
        )
        # 运营+超管可看完整字段
        if has_permission(current.role, "account:view_all"):
            item.password = acc.password
            item.email = acc.email
            item.email_password = acc.email_password
        result.append(item)
    return result


@router.post("/import")
def import_accounts(
    req: AccountImport,
    db: Session = Depends(get_db),
    current: User = Depends(require_permission("account:import")),
):
    """批量导入账号。格式：用户名|密码|邮箱|邮箱密码"""
    from douyu.email_verifier import get_email_config_for_account

    accounts = []
    skipped = 0
    for line_num, line in enumerate(req.text.strip().split('\n'), 1):
        line = line.strip()
        if not line or line.startswith('#'):
            continue
        parts = _split_account_line(line)
        if len(parts) != 4:
            skipped += 1
            continue

        username, password, email, email_password = [p.strip() for p in parts]
        if not all([username, password, email, email_password]):
            skipped += 1
            continue
        if not EMAIL_PATTERN.match(email):
            skipped += 1
            continue

        email_cfg = get_email_config_for_account(email)
        accounts.append(Account(
            username=username,
            password=password,
            email=email,
            email_password=email_password,
            email_imap_server=email_cfg['server'],
            email_imap_port=email_cfg.get('port', 993),
        ))

    if accounts:
        db.add_all(accounts)
        db.add(AuditLog(user_id=current.id, username=current.username,
                        action="account:import", target=f"导入{len(accounts)}个"))
        db.commit()

    return {"message": f"导入成功 {len(accounts)} 个，跳过 {skipped} 个", "success": True, "count": len(accounts)}


@router.put("/{account_id}/assign")
def assign_account(
    account_id: int,
    req: AccountAssign,
    db: Session = Depends(get_db),
    current: User = Depends(require_permission("account:assign")),
):
    acc = db.query(Account).filter(Account.id == account_id).first()
    if not acc:
        raise HTTPException(status_code=404, detail="账号不存在")

    if req.assigned_to:
        target = db.query(User).filter(User.id == req.assigned_to).first()
        if not target:
            raise HTTPException(status_code=404, detail="目标用户不存在")
        if target.role != "support":
            raise HTTPException(status_code=400, detail="只能分配给客服角色")

    acc.assigned_to = req.assigned_to
    db.add(AuditLog(user_id=current.id, username=current.username,
                    action="account:assign", target=acc.username))
    db.commit()
    return {"message": "已分配", "success": True}


@router.delete("/{account_id}")
def delete_account(
    account_id: int,
    db: Session = Depends(get_db),
    current: User = Depends(require_permission("account:delete")),
):
    acc = db.query(Account).filter(Account.id == account_id).first()
    if not acc:
        raise HTTPException(status_code=404, detail="账号不存在")

    db.add(AuditLog(user_id=current.id, username=current.username,
                    action="account:delete", target=acc.username))
    db.delete(acc)
    db.commit()
    return {"message": "已删除", "success": True}