"""Contact folder permission routes — ACL management."""

from __future__ import annotations

import uuid

from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.db import get_db
from app.deps import require_permission
from app.schemas.contact_folder_permission import (
    FolderPermissionCreate,
    FolderPermissionUpdate,
)
from app.services import contact_folder_permission_service

router = APIRouter(prefix="/api/v1/contact-folders", tags=["contact-folder-permissions"])


@router.get("/{folder_id}/permissions")
async def list_folder_permissions(
    folder_id: str,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("contacts:read")),
):
    """List all permission entries for a folder."""
    tenant_id = uuid.UUID(current_user["tenant_id"])
    try:
        items = await contact_folder_permission_service.list_permissions(db, tenant_id, folder_id)
    except ValueError as e:
        raise HTTPException(status_code=404, detail=str(e))
    return {"items": items, "total": len(items)}


@router.post("/{folder_id}/permissions", status_code=status.HTTP_201_CREATED)
async def create_folder_permission(
    folder_id: str,
    body: FolderPermissionCreate,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("contacts:write")),
):
    """Grant or update a permission on a folder for a user or group."""
    tenant_id = uuid.UUID(current_user["tenant_id"])
    try:
        return await contact_folder_permission_service.create_permission(
            db,
            tenant_id,
            folder_id,
            body.user_id,
            body.group_id,
            body.permission_level,
            body.inherit_to_subfolders,
        )
    except ValueError as e:
        raise HTTPException(status_code=400, detail=str(e))


@router.put("/{folder_id}/permissions/{permission_id}")
async def update_folder_permission(
    folder_id: str,
    permission_id: str,
    body: FolderPermissionUpdate,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("contacts:write")),
):
    """Update an existing permission entry."""
    tenant_id = uuid.UUID(current_user["tenant_id"])
    try:
        return await contact_folder_permission_service.update_permission(
            db,
            tenant_id,
            permission_id,
            body.permission_level,
            body.inherit_to_subfolders,
        )
    except ValueError as e:
        raise HTTPException(status_code=404, detail=str(e))


@router.delete("/{folder_id}/permissions/{permission_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_folder_permission(
    folder_id: str,
    permission_id: str,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("contacts:write")),
):
    """Revoke a permission entry."""
    tenant_id = uuid.UUID(current_user["tenant_id"])
    try:
        await contact_folder_permission_service.delete_permission(db, tenant_id, permission_id)
    except ValueError as e:
        raise HTTPException(status_code=404, detail=str(e))


@router.get("/{folder_id}/access")
async def get_folder_access(
    folder_id: str,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("contacts:read")),
):
    """Get effective access level for the current user on a folder."""
    tenant_id = uuid.UUID(current_user["tenant_id"])
    user_id = uuid.UUID(current_user["user_id"])
    return await contact_folder_permission_service.get_effective_access(
        db, tenant_id, user_id, uuid.UUID(folder_id)
    )