# retoor <retoor@molodetz.nl>
from fastapi import APIRouter, HTTPException, Request

from molodetz.database import get_user, list_users, set_role
from molodetz.dependencies import json_or_form
from molodetz.models import RoleForm
from molodetz.responses import action_result, respond
from molodetz.routers.admin._shared import admin_seo
from molodetz.schemas.admin import AdminUsersOut
from molodetz.utils.audit import record
from molodetz.utils.auth import invalidate_user_cache, is_senior_admin, not_found, require_admin

router = APIRouter()


@router.get("/users")
async def users_index(request: Request):
    require_admin(request)
    return respond(request, "admin/users.html", {"users": list_users(), "seo": admin_seo(request, "Accounts")}, model=AdminUsersOut)


@router.post("/users/{uid}/role")
async def users_role(request: Request, uid: str):
    actor = require_admin(request)
    target = get_user(uid)
    if target is None:
        not_found("Account niet gevonden")
    data = await json_or_form(request, RoleForm)
    if is_senior_admin(actor, target) or (target["uid"] == actor["uid"] and data.role != "Admin"):
        record(request, "admin.user.role", result="denied", targets=[("user", uid)], user=actor)
        raise HTTPException(403, "Je kunt een senior beheerder niet beheren")
    set_role(uid, data.role)
    invalidate_user_cache(propagate=True)
    record(request, "admin.user.role", payload={"role": data.role}, targets=[("user", uid)], user=actor)
    return action_result(request, "/admin/users", data={"uid": uid, "role": data.role})