"""Kullanıcı talepleri: gönderim (herkes) + admin gelen kutusu."""
from flask import Blueprint, abort, flash, redirect, render_template, request, session, url_for

import security
from db import get_db

request_bp = Blueprint("talepler", __name__)

SUBJECT_MAX = 150
BODY_MAX = 5000
NAME_MAX = 100


@request_bp.get("/talep")
def new_talep():
    return render_template(
        "new_talep.html",
        prefill_name=session.get("name", ""),
        prefill_email=session.get("email", ""),
    )


@request_bp.post("/talep")
@security.rate_limited("talep", 6, 900)
def do_talep():
    sender_name = security.clean_text(request.form.get("sender_name"), NAME_MAX)
    sender_email = security.validate_email(request.form.get("sender_email"))
    subject = security.clean_text(request.form.get("subject"), SUBJECT_MAX)
    body = security.clean_multiline(request.form.get("body"), BODY_MAX)

    if not sender_name:
        flash("Adınızı yazmalısınız.", "error")
        return redirect(url_for("talepler.new_talep"))
    if sender_email is None:
        flash("Geçerli bir e-posta adresi girin.", "error")
        return redirect(url_for("talepler.new_talep"))
    if not subject:
        flash("Talep başlığı zorunlu.", "error")
        return redirect(url_for("talepler.new_talep"))
    if not body:
        flash("Talep açıklaması boş olamaz.", "error")
        return redirect(url_for("talepler.new_talep"))

    db = get_db()
    db.execute(
        "INSERT INTO requests (sender_name, sender_email, subject, body) VALUES (?, ?, ?, ?)",
        (sender_name, sender_email, subject, body),
    )
    db.commit()
    flash("Talebiniz iletildi. Teşekkürler!", "success")
    return redirect(url_for("index"))


@request_bp.get("/admin/talepler")
def admin_inbox():
    if session.get("role") != "admin":
        abort(403)
    db = get_db()
    requests = db.execute(
        "SELECT * FROM requests ORDER BY created_at DESC"
    ).fetchall()
    return render_template("admin/requests.html", requests=requests)


@request_bp.post("/admin/talepler/<int:rid>/sil")
def admin_delete(rid):
    if session.get("role") != "admin":
        abort(403)
    db = get_db()
    db.execute("DELETE FROM requests WHERE id = ?", (rid,))
    db.commit()
    flash("Talep silindi.", "info")
    return redirect(url_for("talepler.admin_inbox"))