HarborForge.Backend/app/api/routers/users.py

"""Users router."""
from datetime import datetime
from typing import List

from fastapi import APIRouter, Depends, HTTPException, status
from pydantic import BaseModel
from sqlalchemy.exc import IntegrityError
from sqlalchemy.orm import Session

from app.api.deps import get_current_user, get_current_user_or_apikey, get_password_hash, hash_api_key
from app.core.config import get_db, settings
from app.init_bootstrap import DELETED_USER_USERNAME
from app.models import models
from app.models.agent import Agent
from app.models.role_permission import Permission, Role, RolePermission
from app.models.worklog import WorkLog
from app.schemas import schemas

router = APIRouter(prefix="/users", tags=["Users"])


def _user_response(user: models.User) -> dict:
    """Build a UserResponse-compatible dict that includes the agent_id when present."""
    data = {
        "id": user.id,
        "username": user.username,
        "email": user.email,
        "full_name": user.full_name,
        "is_active": user.is_active,
        "is_admin": user.is_admin,
        "role_id": user.role_id,
        "role_name": user.role_name,
        "agent_id": user.agent.agent_id if user.agent else None,
        "discord_user_id": user.discord_user_id,
        "oidc_issuer": user.oidc_issuer,
        "oidc_subject": user.oidc_subject,
        "created_at": user.created_at,
    }
    return data


def require_admin(current_user: models.User = Depends(get_current_user_or_apikey)):
    # Accept either OAuth2 JWT or X-API-Key (incl. Bearer-as-apikey fallback)
    # so CLI clients using their provisioned api-key can hit admin-gated user
    # routes (list / get / update / patch). The admin gate still reads
    # User.is_admin — only the auth carrier broadens.
    if not current_user.is_admin:
        raise HTTPException(status_code=403, detail="Admin required")
    return current_user


def _has_global_permission(db: Session, user: models.User, permission_name: str) -> bool:
    if user.is_admin:
        return True
    if not user.role_id:
        return False
    perm = db.query(Permission).filter(Permission.name == permission_name).first()
    if not perm:
        return False
    return db.query(RolePermission).filter(
        RolePermission.role_id == user.role_id,
        RolePermission.permission_id == perm.id,
    ).first() is not None


def require_account_creator(
    db: Session = Depends(get_db),
    current_user: models.User = Depends(get_current_user_or_apikey),
):
    if current_user.is_admin or _has_global_permission(db, current_user, "account.create"):
        return current_user
    raise HTTPException(status_code=403, detail="Account creation permission required")


def _resolve_user_role(db: Session, role_id: int | None, *, is_agent: bool = False) -> Role:
    """Resolve target role for user creation.

    Default policy when caller didn't pin role_id:
      - is_agent (i.e. payload had agent_id/claw_identifier) → general-agent
      - human user                                            → guest

    general-agent ≈ guest + user.reset-self-apikey so agents can rotate
    their own API key without admin intervention. Created in
    init_bootstrap.py on every startup; falls back to guest if absent
    (e.g. very old DB that hasn't been re-seeded yet).
    """
    if role_id is None:
        default_name = "general-agent" if is_agent else "guest"
        role = db.query(Role).filter(Role.name == default_name).first()
        if not role and is_agent:
            # general-agent missing from this DB → fall back to guest, log warn
            role = db.query(Role).filter(Role.name == "guest").first()
        if not role:
            raise HTTPException(
                status_code=500,
                detail=f"Default role '{default_name}' is missing (DB not seeded)",
            )
        return role

    role = db.query(Role).filter(Role.id == role_id).first()
    if not role:
        raise HTTPException(status_code=400, detail="Role not found")
    if role.name == "admin":
        raise HTTPException(status_code=400, detail="Admin role cannot be assigned via user management")
    if role.is_global is False:
        raise HTTPException(status_code=400, detail="Only global roles can be assigned to accounts")
    return role


@router.post("", response_model=schemas.UserResponse, status_code=status.HTTP_201_CREATED)
def create_user(
    user: schemas.UserCreate,
    db: Session = Depends(get_db),
    _: models.User = Depends(require_account_creator),
):
    # Validate agent_id / claw_identifier: both or neither
    has_agent_id = bool(user.agent_id)
    has_claw = bool(user.claw_identifier)
    if has_agent_id != has_claw:
        raise HTTPException(
            status_code=400,
            detail="agent_id and claw_identifier must both be provided or both omitted",
        )

    existing = db.query(models.User).filter(
        (models.User.username == user.username) | (models.User.email == user.email)
    ).first()
    if existing:
        raise HTTPException(status_code=400, detail="Username or email already exists")

    # Check agent_id uniqueness
    if has_agent_id:
        existing_agent = db.query(Agent).filter(Agent.agent_id == user.agent_id).first()
        if existing_agent:
            raise HTTPException(status_code=400, detail="agent_id already in use")

    assigned_role = _resolve_user_role(db, user.role_id, is_agent=has_agent_id)
    # In OIDC-only mode, ignore any supplied password: the user is created
    # passwordless (cannot password-login) and is expected to sign in via a
    # bound OIDC identity. API keys still work for such users.
    if settings.HARBORFORGE_OIDC_ONLY:
        hashed_password = None
    else:
        hashed_password = get_password_hash(user.password) if user.password else None
    db_user = models.User(
        username=user.username,
        email=user.email,
        full_name=user.full_name,
        discord_user_id=user.discord_user_id,
        hashed_password=hashed_password,
        is_admin=False,
        is_active=True,
        role_id=assigned_role.id,
    )
    db.add(db_user)
    db.flush()  # get db_user.id

    # Create Agent record if agent binding is requested (BE-CAL-003)
    if has_agent_id:
        db_agent = Agent(
            user_id=db_user.id,
            agent_id=user.agent_id,
            claw_identifier=user.claw_identifier,
        )
        db.add(db_agent)

    db.commit()
    db.refresh(db_user)
    return _user_response(db_user)


@router.get("", response_model=List[schemas.UserResponse])
def list_users(
    skip: int = 0,
    limit: int = 100,
    db: Session = Depends(get_db),
    _: models.User = Depends(require_admin),
):
    users = db.query(models.User).order_by(models.User.created_at.desc()).offset(skip).limit(limit).all()
    return [_user_response(u) for u in users]


def _find_user_by_id_or_username(db: Session, identifier: str) -> models.User | None:
    """Resolve a user by numeric id or username string."""
    try:
        uid = int(identifier)
        return db.query(models.User).filter(models.User.id == uid).first()
    except ValueError:
        return db.query(models.User).filter(models.User.username == identifier).first()


@router.get("/{identifier}", response_model=schemas.UserResponse)
def get_user(
    identifier: str,
    db: Session = Depends(get_db),
    _: models.User = Depends(require_admin),
):
    user = _find_user_by_id_or_username(db, identifier)
    if not user:
        raise HTTPException(status_code=404, detail="User not found")
    return _user_response(user)


@router.patch("/{identifier}", response_model=schemas.UserResponse)
def update_user(
    identifier: str,
    payload: schemas.UserUpdate,
    db: Session = Depends(get_db),
    current_user: models.User = Depends(require_admin),
):
    user = _find_user_by_id_or_username(db, identifier)
    if not user:
        raise HTTPException(status_code=404, detail="User not found")

    if payload.email is not None and payload.email != user.email:
        existing = db.query(models.User).filter(models.User.email == payload.email, models.User.id != user.id).first()
        if existing:
            raise HTTPException(status_code=400, detail="Email already exists")
        user.email = payload.email

    if payload.full_name is not None:
        user.full_name = payload.full_name

    if payload.password is not None and payload.password.strip() and not settings.HARBORFORGE_OIDC_ONLY:
        user.hashed_password = get_password_hash(payload.password)

    if payload.role_id is not None:
        if user.is_admin:
            raise HTTPException(status_code=400, detail="Admin accounts cannot be reassigned via user management")
        assigned_role = _resolve_user_role(db, payload.role_id)
        user.role_id = assigned_role.id

    if payload.is_active is not None:
        if current_user.id == user.id and payload.is_active is False:
            raise HTTPException(status_code=400, detail="You cannot deactivate your own account")
        user.is_active = payload.is_active

    if payload.discord_user_id is not None:
        user.discord_user_id = payload.discord_user_id or None

    db.commit()
    db.refresh(user)
    return _user_response(user)


@router.patch("/{identifier}/bind-agent", response_model=schemas.UserResponse)
def bind_agent(
    identifier: str,
    payload: schemas.UserBindAgentRequest,
    db: Session = Depends(get_db),
    _: models.User = Depends(require_account_creator),
):
    """Bind an existing user to (agent_id, claw_identifier).

    Backfill path for users that were created via `hf user create` before
    the cli supported `--agent-id` / `--claw-identifier` flags. Creates
    the `agents` row that should have been written at user-create time.

    Idempotent: if the user is already bound to the same
    (agent_id, claw_identifier), returns the user unchanged (200, no-op).

    Rejects (409) if:
      - the user is bound to a DIFFERENT (agent_id, claw_identifier)
      - the requested agent_id is already in use by another user

    Permission: account.create (admin auto-grants) — same gate as
    POST /users so the surface stays symmetric.
    """
    user = _find_user_by_id_or_username(db, identifier)
    if not user:
        raise HTTPException(status_code=404, detail="User not found")

    existing_agent_for_user = db.query(Agent).filter(Agent.user_id == user.id).first()
    if existing_agent_for_user:
        if (
            existing_agent_for_user.agent_id == payload.agent_id
            and existing_agent_for_user.claw_identifier == payload.claw_identifier
        ):
            # idempotent re-bind
            return _user_response(user)
        raise HTTPException(
            status_code=409,
            detail=(
                f"User '{user.username}' is already bound to agent "
                f"'{existing_agent_for_user.agent_id}' on claw "
                f"'{existing_agent_for_user.claw_identifier}'"
            ),
        )

    existing_for_agent_id = (
        db.query(Agent).filter(Agent.agent_id == payload.agent_id).first()
    )
    if existing_for_agent_id:
        raise HTTPException(
            status_code=409,
            detail=f"agent_id '{payload.agent_id}' already in use by another user",
        )

    db.add(
        Agent(
            user_id=user.id,
            agent_id=payload.agent_id,
            claw_identifier=payload.claw_identifier,
        )
    )
    db.commit()
    db.refresh(user)
    return _user_response(user)


_BUILTIN_USERNAMES = {"acc-mgr", DELETED_USER_USERNAME}


def _reassign_user_references(db: Session, old_id: int, new_id: int) -> None:
    """Reassign all foreign key references from old_id to new_id, then delete
    records that would be meaningless under deleted-user (api_keys, notifications,
    project memberships)."""
    from app.models.apikey import APIKey
    from app.models.notification import Notification
    from app.models.activity import ActivityLog as Activity
    from app.models.worklog import WorkLog as WorkLogModel
    from app.models.meeting import Meeting, MeetingParticipant
    from app.models.task import Task
    from app.models.support import Support
    from app.models.proposal import Proposal
    from app.models.milestone import Milestone
    from app.models.calendar import TimeSlot, SchedulePlan
    from app.models.minimum_workload import MinimumWorkload
    from app.models.essential import Essential

    # Delete records that are meaningless without the real user
    db.query(APIKey).filter(APIKey.user_id == old_id).delete()
    db.query(Notification).filter(Notification.user_id == old_id).delete()
    db.query(models.ProjectMember).filter(models.ProjectMember.user_id == old_id).delete()

    # Reassign ownership/authorship references
    db.query(models.Project).filter(models.Project.owner_id == old_id).update(
        {"owner_id": new_id})
    db.query(models.Comment).filter(models.Comment.author_id == old_id).update(
        {"author_id": new_id})
    db.query(Activity).filter(Activity.user_id == old_id).update(
        {"user_id": new_id})
    db.query(WorkLogModel).filter(WorkLogModel.user_id == old_id).update(
        {"user_id": new_id})

    # Tasks
    db.query(Task).filter(Task.reporter_id == old_id).update(
        {"reporter_id": new_id})
    db.query(Task).filter(Task.assignee_id == old_id).update(
        {"assignee_id": new_id})
    db.query(Task).filter(Task.created_by_id == old_id).update(
        {"created_by_id": new_id})

    # Meetings
    db.query(Meeting).filter(Meeting.reporter_id == old_id).update(
        {"reporter_id": new_id})
    db.query(MeetingParticipant).filter(MeetingParticipant.user_id == old_id).update(
        {"user_id": new_id})

    # Support
    db.query(Support).filter(Support.reporter_id == old_id).update(
        {"reporter_id": new_id})
    db.query(Support).filter(Support.assignee_id == old_id).update(
        {"assignee_id": new_id})

    # Proposals
    db.query(Proposal).filter(Proposal.created_by_id == old_id).update(
        {"created_by_id": new_id})

    # Milestones
    db.query(Milestone).filter(Milestone.created_by_id == old_id).update(
        {"created_by_id": new_id})

    # Calendar
    db.query(TimeSlot).filter(TimeSlot.user_id == old_id).update(
        {"user_id": new_id})
    db.query(SchedulePlan).filter(SchedulePlan.user_id == old_id).update(
        {"user_id": new_id})

    # Minimum workload / Essential
    db.query(MinimumWorkload).filter(MinimumWorkload.user_id == old_id).update(
        {"user_id": new_id})
    db.query(Essential).filter(Essential.created_by_id == old_id).update(
        {"created_by_id": new_id})

    # Agent profile
    db.query(Agent).filter(Agent.user_id == old_id).update(
        {"user_id": new_id})


@router.delete("/{identifier}", status_code=status.HTTP_204_NO_CONTENT)
def delete_user(
    identifier: str,
    db: Session = Depends(get_db),
    current_user: models.User = Depends(require_admin),
):
    user = _find_user_by_id_or_username(db, identifier)
    if not user:
        raise HTTPException(status_code=404, detail="User not found")
    if current_user.id == user.id:
        raise HTTPException(status_code=400, detail="You cannot delete your own account")
    if user.is_admin:
        raise HTTPException(status_code=400, detail="Admin accounts cannot be deleted")
    if user.username in _BUILTIN_USERNAMES:
        raise HTTPException(
            status_code=400,
            detail=f"The {user.username} account is a built-in account and cannot be deleted",
        )

    deleted_user = db.query(models.User).filter(
        models.User.username == DELETED_USER_USERNAME
    ).first()
    if not deleted_user:
        raise HTTPException(
            status_code=500,
            detail="Built-in deleted-user account not found. Backend startup failed to seed it; restart the container.",
        )

    _reassign_user_references(db, user.id, deleted_user.id)
    db.delete(user)
    db.commit()
    return None


@router.post("/{identifier}/reset-apikey")
def reset_user_apikey(
    identifier: str,
    db: Session = Depends(get_db),
    current_user: models.User = Depends(get_current_user_or_apikey),
):
    """Reset (regenerate) a user's API key.

    Permission rules:
    - user.reset-apikey: can reset any user's API key
    - user.reset-self-apikey: can reset only own API key
    - admin: can reset any user's API key

    Accepts both OAuth2 Bearer token and X-API-Key authentication.
    """
    import secrets
    from app.models.apikey import APIKey

    target_user = _find_user_by_id_or_username(db, identifier)
    if not target_user:
        raise HTTPException(status_code=404, detail="User not found")

    is_self = current_user.id == target_user.id
    can_reset_any = _has_global_permission(db, current_user, "user.reset-apikey")
    can_reset_self = _has_global_permission(db, current_user, "user.reset-self-apikey")

    if not (can_reset_any or (is_self and can_reset_self)):
        raise HTTPException(status_code=403, detail="API key reset permission required")

    # Find existing active API key for target user, or create one
    existing_key = db.query(APIKey).filter(
        APIKey.user_id == target_user.id,
        APIKey.is_active == True,
    ).first()

    new_key_value = secrets.token_hex(32)

    if existing_key:
        # Deactivate old key
        existing_key.is_active = False
        db.flush()

    # Create new key (store only the hash + a display prefix)
    new_key = APIKey(
        key_hash=hash_api_key(new_key_value),
        key_prefix=new_key_value[:8],
        name=f"{target_user.username}-key",
        user_id=target_user.id,
        is_active=True,
    )
    db.add(new_key)
    db.commit()
    db.refresh(new_key)

    return {
        "user_id": target_user.id,
        "username": target_user.username,
        "api_key": new_key_value,
        "message": "API key has been reset. Please save this key — it will not be shown again.",
    }


class WorkLogResponse(BaseModel):
    id: int
    task_id: int
    user_id: int
    hours: float
    description: str | None = None
    logged_date: datetime
    created_at: datetime

    class Config:
        from_attributes = True


@router.get("/{identifier}/worklogs", response_model=List[WorkLogResponse])
def list_user_worklogs(
    identifier: str,
    limit: int = 50,
    db: Session = Depends(get_db),
    current_user: models.User = Depends(get_current_user),
):
    user = _find_user_by_id_or_username(db, identifier)
    if not user:
        raise HTTPException(status_code=404, detail="User not found")
    if current_user.id != user.id and not current_user.is_admin:
        raise HTTPException(status_code=403, detail="Forbidden")
    return db.query(WorkLog).filter(WorkLog.user_id == user.id).order_by(WorkLog.logged_date.desc()).limit(limit).all()


# ---- OIDC identity binding ------------------------------------------------

class OidcBindingRequest(BaseModel):
    issuer: str
    subject: str


class OidcBindingResponse(BaseModel):
    user_id: int
    username: str
    oidc_issuer: str | None = None
    oidc_subject: str | None = None


def _assert_can_manage_oidc_binding(db: Session, caller: models.User, target: models.User) -> None:
    """Global admins may (un)bind anyone. Non-admin account managers may
    only operate on non-privileged accounts — never on an admin or another
    privileged account — otherwise binding an attacker-controlled OIDC
    identity to an admin would be a privilege-escalation primitive."""
    if getattr(caller, "is_admin", False):
        return
    privileged = (
        getattr(target, "is_admin", False)
        or target.username in ("acc-mgr", "deleted-user")
        or _has_global_permission(db, target, "account.create")
        or _has_global_permission(db, target, "user.reset-apikey")
    )
    if privileged:
        raise HTTPException(
            status_code=403,
            detail="Only a global admin may manage the OIDC binding of a privileged account",
        )


@router.put("/{identifier}/oidc-binding", response_model=OidcBindingResponse)
def bind_user_oidc(
    identifier: str,
    payload: OidcBindingRequest,
    db: Session = Depends(get_db),
    caller: models.User = Depends(require_account_creator),
):
    """Bind an hf user to an external OIDC identity (issuer + subject).

    Admin or account-manager (JWT or API key). Account managers may not
    target privileged/admin accounts. One OIDC identity maps to at most
    one user."""
    issuer = (payload.issuer or "").strip()
    subject = (payload.subject or "").strip()
    if not issuer or not subject:
        raise HTTPException(status_code=400, detail="issuer and subject are required")
    user = _find_user_by_id_or_username(db, identifier)
    if not user:
        raise HTTPException(status_code=404, detail="User not found")
    _assert_can_manage_oidc_binding(db, caller, user)
    clash = db.query(models.User).filter(
        models.User.oidc_issuer == issuer,
        models.User.oidc_subject == subject,
        models.User.id != user.id,
    ).first()
    if clash:
        raise HTTPException(status_code=409, detail=f"OIDC identity already bound to user '{clash.username}'")
    user.oidc_issuer = issuer
    user.oidc_subject = subject
    db.commit()
    db.refresh(user)
    return OidcBindingResponse(user_id=user.id, username=user.username,
                               oidc_issuer=user.oidc_issuer, oidc_subject=user.oidc_subject)


@router.delete("/{identifier}/oidc-binding", response_model=OidcBindingResponse)
def unbind_user_oidc(
    identifier: str,
    db: Session = Depends(get_db),
    caller: models.User = Depends(require_account_creator),
):
    """Remove a user's OIDC binding. Admin or account-manager; account
    managers may not target privileged/admin accounts."""
    user = _find_user_by_id_or_username(db, identifier)
    if not user:
        raise HTTPException(status_code=404, detail="User not found")
    _assert_can_manage_oidc_binding(db, caller, user)
    user.oidc_issuer = None
    user.oidc_subject = None
    db.commit()
    db.refresh(user)
    return OidcBindingResponse(user_id=user.id, username=user.username,
                               oidc_issuer=None, oidc_subject=None)