leocrm/app/routes/saved_views.py

"""Saved views routes — CRUD for reusable view configurations."""

from __future__ import annotations

import uuid
from datetime import UTC
from typing import Any

from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
from pydantic import BaseModel, Field
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.db import get_db
from app.deps import get_current_user, require_permission
from app.models.saved_view import SavedView

router = APIRouter(prefix="/api/v1/saved-views", tags=["saved-views"])

VALID_ENTITY_TYPES = None  # Dynamic — validated against ENTITY_MODELS at runtime


def _validate_entity_type(entity_type: str) -> None:
    """Validate entity_type against ENTITY_MODELS. Raises HTTPException if invalid."""
    from app.services.entity_permission_service import ENTITY_MODELS
    if entity_type not in ENTITY_MODELS:
        from fastapi import HTTPException
        valid = sorted(ENTITY_MODELS.keys())
        raise HTTPException(400, detail={
            "detail": f"Invalid entity_type: {entity_type}",
            "code": "invalid_entity_type",
            "valid_types": valid,
        })


class SavedViewCreate(BaseModel):
    """Schema for creating a saved view."""
    name: str = Field(..., min_length=1, max_length=100)
    entity_type: str = Field(..., min_length=1, max_length=50)
    view_config: dict[str, Any] = Field(default_factory=dict)


class SavedViewUpdate(BaseModel):
    """Schema for updating a saved view."""
    name: str | None = Field(default=None, min_length=1, max_length=100)
    view_config: dict[str, Any] | None = None


def _view_to_dict(v: SavedView) -> dict[str, Any]:
    return {
        "id": str(v.id),
        "name": v.name,
        "entity_type": v.entity_type,
        "view_config": v.view_config,
        "user_id": str(v.user_id),
        "created_at": v.created_at.isoformat() if v.created_at else None,
        "updated_at": v.updated_at.isoformat() if v.updated_at else None,
    }


@router.get("")
async def list_saved_views(
    entity_type: str | None = Query(None),
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(get_current_user),
):
    """List saved views for the current user, optionally filtered by entity_type."""
    tenant_id = uuid.UUID(current_user["tenant_id"])
    user_id = uuid.UUID(current_user["user_id"])

    try:
        query = select(SavedView).where(
            SavedView.tenant_id == tenant_id,
            SavedView.user_id == user_id,
            SavedView.deleted_at.is_(None),
        )
        if entity_type:
            query = query.where(SavedView.entity_type == entity_type)
        query = query.order_by(SavedView.name)

        result = await db.execute(query)
        views = result.scalars().all()
        return [_view_to_dict(v) for v in views]
    except PermissionError as e:
        raise HTTPException(status_code=403, detail=str(e)) from e


@router.post("", status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_permission("contacts:read"))])
async def create_saved_view(
    body: SavedViewCreate,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(get_current_user),
):
    """Create a new saved view for the current user."""
    _validate_entity_type(body.entity_type)
    tenant_id = uuid.UUID(current_user["tenant_id"])
    user_id = uuid.UUID(current_user["user_id"])

    try:
        # Check uniqueness within user+entity
        existing = await db.execute(
            select(SavedView).where(
                SavedView.tenant_id == tenant_id,
                SavedView.user_id == user_id,
                SavedView.entity_type == body.entity_type,
                SavedView.name == body.name,
                SavedView.deleted_at.is_(None),
            )
        )
        if existing.scalar_one_or_none() is not None:
            raise HTTPException(409, detail={"detail": "View name already exists", "code": "duplicate"})

        saved = SavedView(
            tenant_id=tenant_id,
            user_id=user_id,
            name=body.name,
            entity_type=body.entity_type,
            view_config=body.view_config,
        )
        db.add(saved)
        await db.flush()
        return _view_to_dict(saved)
    except PermissionError as e:
        raise HTTPException(status_code=403, detail=str(e)) from e


@router.put("/{view_id}", dependencies=[Depends(require_permission("contacts:read"))])
async def update_saved_view(
    view_id: str,
    body: SavedViewUpdate,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(get_current_user),
):
    """Update a saved view."""
    tenant_id = uuid.UUID(current_user["tenant_id"])
    user_id = uuid.UUID(current_user["user_id"])

    try:
        try:
            vid = uuid.UUID(view_id)
        except (ValueError, TypeError):
            raise HTTPException(400, detail={"detail": "Invalid view_id", "code": "invalid_id"}) from None

        result = await db.execute(
            select(SavedView).where(
                SavedView.id == vid,
                SavedView.tenant_id == tenant_id,
                SavedView.user_id == user_id,
                SavedView.deleted_at.is_(None),
            )
        )
        saved = result.scalar_one_or_none()
        if saved is None:
            raise HTTPException(404, detail={"detail": "Saved view not found", "code": "not_found"})

        if body.name is not None:
            saved.name = body.name
        if body.view_config is not None:
            saved.view_config = body.view_config
        await db.flush()
        return _view_to_dict(saved)
    except PermissionError as e:
        raise HTTPException(status_code=403, detail=str(e)) from e


@router.delete("/{view_id}", status_code=status.HTTP_204_NO_CONTENT, dependencies=[Depends(require_permission("contacts:read"))])
async def delete_saved_view(
    view_id: str,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(get_current_user),
):
    """Delete a saved view (soft-delete)."""
    tenant_id = uuid.UUID(current_user["tenant_id"])
    user_id = uuid.UUID(current_user["user_id"])

    try:
        try:
            vid = uuid.UUID(view_id)
        except (ValueError, TypeError):
            raise HTTPException(400, detail={"detail": "Invalid view_id", "code": "invalid_id"}) from None

        result = await db.execute(
            select(SavedView).where(
                SavedView.id == vid,
                SavedView.tenant_id == tenant_id,
                SavedView.user_id == user_id,
                SavedView.deleted_at.is_(None),
            )
        )
        saved = result.scalar_one_or_none()
        if saved is None:
            raise HTTPException(404, detail={"detail": "Saved view not found", "code": "not_found"})

        from datetime import datetime
        saved.deleted_at = datetime.now(UTC)
        await db.flush()
        return Response(status_code=status.HTTP_204_NO_CONTENT)
    except PermissionError as e:
        raise HTTPException(status_code=403, detail=str(e)) from e