"""管理域 API：用户管理/日志查看。"""
import time

from flask import Blueprint, jsonify, request
from flask_login import current_user
from flask import session

from core import logger
from core.logger import get_logger
from core.models import db, User
from web import context
from web.auth import (admin_required, perm_required, _validate_perms,
                             PERM_LOGS)

_log = get_logger("web")
bp = Blueprint("admin", __name__)

@bp.route("/api/users")
@admin_required
def api_users_list():
    users = [{"id": u.id, "username": u.username,
              "is_admin": u.is_admin, "perms": u.get_perms()} for u in User.query.all()]
    return jsonify({"ok": True, "users": users})

@bp.route("/api/users", methods=["POST"])
@admin_required
def api_users_create():
    data = request.json or {}
    username = (data.get("username") or "").strip()
    password = data.get("password", "")
    if not username or not password:
        return jsonify({"ok": False, "error": "用户名和密码不能为空"}), 400
    if User.query.filter_by(username=username).first():
        return jsonify({"ok": False, "error": "用户名已存在"}), 400
    # 默认普通用户（最小权限）；管理员由 is_admin 决定，权限位照常保存（降级后生效）
    u = User(username=username, is_admin=bool(data.get("is_admin", False)))
    u.set_perms(_validate_perms(data.get("perms") or []))
    u.set_password(password)
    db.session.add(u)
    db.session.commit()
    _log.info(f"创建用户 {username} (admin={u.is_admin}, perms={u.get_perms()})")
    return jsonify({"ok": True, "msg": "用户已创建"})

@bp.route("/api/users/<int:uid>", methods=["PUT"])
@admin_required
def api_users_update(uid):
    u = User.query.get(uid)
    if not u:
        return jsonify({"ok": False, "error": "用户不存在"}), 404
    data = request.json or {}
    if "password" in data and data["password"]:
        u.set_password(data["password"])
    if "is_admin" in data:
        new_admin = bool(data["is_admin"])
        if u.is_admin and not new_admin and User.query.filter_by(is_admin=True).count() <= 1:
            return jsonify({"ok": False, "error": "不能取消最后一个管理员"}), 400
        u.is_admin = new_admin
    if "perms" in data:
        u.set_perms(_validate_perms(data["perms"]))
    db.session.commit()
    _log.info(f"更新用户 {u.username} (admin={u.is_admin}, perms={u.get_perms()})")
    return jsonify({"ok": True, "msg": "用户已更新"})

@bp.route("/api/users/<int:uid>", methods=["DELETE"])
@admin_required
def api_users_delete(uid):
    u = User.query.get(uid)
    if not u:
        return jsonify({"ok": False, "error": "用户不存在"}), 404
    if u.username == "admin":
        return jsonify({"ok": False, "error": "不能删除默认管理员"}), 400
    if u.id == current_user.id:
        return jsonify({"ok": False, "error": "不能删除当前登录用户"}), 400
    if u.is_admin and User.query.filter_by(is_admin=True).count() <= 1:
        return jsonify({"ok": False, "error": "不能删除最后一个管理员"}), 400
    db.session.delete(u)
    db.session.commit()
    _log.info(f"删除用户 {u.username}")
    return jsonify({"ok": True, "msg": "用户已删除"})


# ================== API：日志查看 ==================
#
# 过滤/白名单都在 core.logger 里做（读取侧与写入侧共用同一份文件清单，
# 见 core/logger.py「日志读取」一节）；这里只负责取参数 + 组装响应。


def _log_filters():
    """从 query string 取过滤条件（/api/logs 与 /api/logs/download 共用）。"""
    return dict(keyword=request.args.get("q", ""),
                min_level=request.args.get("level", ""),
                since=request.args.get("since", ""),
                until=request.args.get("until", ""))


@bp.route("/api/logs")
@perm_required(PERM_LOGS)
def api_logs():
    """读日志：可按关键字 / 最低级别 / 时间范围过滤，返回结构化行。

    参数：file 文件名（白名单）、q 关键字、level 最低级别（ERROR 含以上…）、
    since/until 时间、lines 返回条数（取**最近** N 条命中）。
    """
    files = logger.list_log_files()
    names = [f["name"] for f in files]
    # 默认仍落在 core.log（接口按 mtime 倒序返回，names[0] 会随当前哪个模块在
    # 写而漂移，作为"打开日志页时看哪个"不稳定）
    default = "core.log" if "core.log" in names else (names[0] if names else "")
    current = request.args.get("file") or default
    try:
        lines = int(request.args.get("lines", 300))
    except (TypeError, ValueError):
        lines = 300
    res = logger.query_log(current, limit=lines, **_log_filters())
    return jsonify({"ok": not res["error"], "error": res["error"], "file": current,
                    "files": files, "rows": res["rows"], "matched": res["matched"],
                    "scanned": res["scanned"], "truncated": res["truncated"]})


@bp.route("/api/logs/download")
@perm_required(PERM_LOGS)
def api_logs_download():
    """下载日志文件（带同样的过滤条件；无条件时就是整个文件）。

    用 BytesIO 发送而不是 send_file(路径)：Windows 上流式发送时文件句柄可能
    到 close 仍未释放，而日志文件正被日志线程持续写入，按路径发容易踩锁。
    """
    from io import BytesIO
    from flask import send_file
    name = request.args.get("file", "")
    text, err = logger.read_log_text(name, **_log_filters())
    if err:
        return jsonify({"ok": False, "error": err}), 404
    data = text.encode("utf-8")
    fname = f"{name}_{time.strftime('%Y%m%d_%H%M%S')}.txt"
    _log.info("下载日志: %s（%d 字节）by %s", name, len(data),
              getattr(current_user, "username", ""))
    return send_file(BytesIO(data), as_attachment=True, download_name=fname,
                     mimetype="text/plain; charset=utf-8")


# ================== API：运行控制 ==================