from flask import render_template, redirect, url_for, flash, abort
from flask_login import current_user

from . import bp
from .forms import UserForm
from ..extensions import db
from ..models import User, ROLE_ADMIN
from ..decorators import role_required


@bp.route("/")
@role_required(ROLE_ADMIN)
def list_users():
    users = User.query.order_by(User.username).all()
    return render_template("users/list.html", users=users)


@bp.route("/new", methods=["GET", "POST"])
@role_required(ROLE_ADMIN)
def new_user():
    form = UserForm()
    if form.validate_on_submit():
        if User.query.filter_by(username=form.username.data).first():
            flash("That username is already taken.", "danger")
            return render_template("users/form.html", form=form, is_new=True)
        if not form.password.data:
            flash("A password is required for a new user.", "danger")
            return render_template("users/form.html", form=form, is_new=True)

        user = User(
            username=form.username.data,
            email=form.email.data or None,
            role=form.role.data,
            is_active_user=form.is_active_user.data,
        )
        user.set_password(form.password.data)
        db.session.add(user)
        db.session.commit()
        flash(f"User '{user.username}' created.", "success")
        return redirect(url_for("users.list_users"))

    return render_template("users/form.html", form=form, is_new=True)


@bp.route("/<int:user_id>/edit", methods=["GET", "POST"])
@role_required(ROLE_ADMIN)
def edit_user(user_id):
    user = User.query.get_or_404(user_id)
    form = UserForm(obj=user)

    if form.validate_on_submit():
        existing = User.query.filter_by(username=form.username.data).first()
        if existing and existing.id != user.id:
            flash("That username is already taken.", "danger")
            return render_template("users/form.html", form=form, is_new=False, user=user)

        if user.id == current_user.id and form.role.data != ROLE_ADMIN:
            flash("You cannot remove your own admin role.", "danger")
            return render_template("users/form.html", form=form, is_new=False, user=user)

        if user.id == current_user.id and not form.is_active_user.data:
            flash("You cannot deactivate your own account.", "danger")
            return render_template("users/form.html", form=form, is_new=False, user=user)

        user.username = form.username.data
        user.email = form.email.data or None
        user.role = form.role.data
        user.is_active_user = form.is_active_user.data
        if form.password.data:
            user.set_password(form.password.data)
        db.session.commit()
        flash(f"User '{user.username}' updated.", "success")
        return redirect(url_for("users.list_users"))

    return render_template("users/form.html", form=form, is_new=False, user=user)


@bp.route("/<int:user_id>/delete", methods=["POST"])
@role_required(ROLE_ADMIN)
def delete_user(user_id):
    user = User.query.get_or_404(user_id)
    if user.id == current_user.id:
        flash("You cannot delete your own account.", "danger")
        return redirect(url_for("users.list_users"))
    db.session.delete(user)
    db.session.commit()
    flash(f"User '{user.username}' deleted.", "info")
    return redirect(url_for("users.list_users"))