"""Giriş / kayıt / çıkış — düz kullanıcılar ve admin'ler."""
from flask import (
    Blueprint,
    flash,
    redirect,
    render_template,
    request,
    session,
    url_for,
)
from werkzeug.security import check_password_hash, generate_password_hash

import security
from db import get_db

auth_bp = Blueprint("auth", __name__)

MIN_PASSWORD = 8


@auth_bp.get("/giris")
def login_page():
    return render_template("login.html")


def _try_admin(username, password):
    cfg = security.load_server_config()
    for adm in cfg["admins"]:
        if username.lower() == adm["username"].lower():
            if check_password_hash(adm["password_hash"], password):
                return adm
    return None


@auth_bp.post("/giris")
@security.rate_limited("auth", 10, 900)
def do_login():
    username = security.clean_text(request.form.get("username"), 64)
    password = request.form.get("password", "")

    if not username or not password:
        flash("Kullanıcı adı ve şifre gerekli.", "error")
        return redirect(url_for("auth.login_page"))

    adm = _try_admin(username, password)
    if adm is not None:
        session.clear()
        session["role"] = "admin"
        session["admin_name"] = adm["display_name"]
        session.permanent = True
        flash(f"Hoş geldiniz, {adm['display_name']}.", "success")
        return redirect(url_for("projects.admin_panel"))

    db = get_db()
    user = db.execute(
        "SELECT * FROM users WHERE username = ? COLLATE NOCASE", (username,)
    ).fetchone()
    if user is None or not check_password_hash(user["password_hash"], password):
        flash("Kullanıcı adı veya şifre hatalı.", "error")
        return redirect(url_for("auth.login_page"))

    session.clear()
    session["user_id"] = user["id"]
    session["name"] = user["display_name"]
    session.permanent = True
    flash(f"Tekrar hoş geldiniz, {user['display_name']}.", "success")
    return redirect(url_for("index"))


@auth_bp.get("/kayit")
def kayit():
    if session.get("user_id"):
        return redirect(url_for("index"))
    return render_template("register.html")


@auth_bp.post("/kayit")
@security.rate_limited("register", 8, 3600)
def do_register():
    username = security.validate_username(request.form.get("username"))
    name = security.clean_text(request.form.get("display_name"), 100)
    password = request.form.get("password", "")
    confirm = request.form.get("password_confirm", "")

    if not username:
        flash("Kullanıcı adı 3-32 karakter olmalı (harfler, rakamlar, . _ -).", "error")
        return redirect(url_for("auth.kayit"))
    if not name:
        flash("Ad Soyad zorunlu.", "error")
        return redirect(url_for("auth.kayit"))
    if len(password) < MIN_PASSWORD:
        flash("Şifre en az 8 karakter olmalı.", "error")
        return redirect(url_for("auth.kayit"))
    if password != confirm:
        flash("Şifreler eşleşmiyor.", "error")
        return redirect(url_for("auth.kayit"))

    db = get_db()
    exists = db.execute(
        "SELECT 1 FROM users WHERE username = ? COLLATE NOCASE", (username,)
    ).fetchone()
    if exists:
        flash("Bu kullanıcı adı zaten kullanılıyor.", "error")
        return redirect(url_for("auth.kayit"))

    db.execute(
        "INSERT INTO users (username, display_name, password_hash) VALUES (?, ?, ?)",
        (username, name, generate_password_hash(password, method="pbkdf2:sha256")),
    )
    db.commit()

    uid = db.execute(
        "SELECT id FROM users WHERE username = ? COLLATE NOCASE", (username,)
    ).fetchone()["id"]
    session.clear()
    session["user_id"] = uid
    session["name"] = name
    session.permanent = True
    flash("Hesabınız oluşturuldu.", "success")
    return redirect(url_for("index"))


@auth_bp.post("/cikis")
def cikis():
    session.clear()
    flash("Çıkış yapıldı.", "info")
    return redirect(url_for("index"))