"""
Master-admin Credentials API — platform admins manage the API keys
(Gemini, Google Translate, SMTP, ...) that the backend loads dynamically.
"""
from rest_framework import status
from rest_framework.permissions import IsAuthenticated
from rest_framework.response import Response
from rest_framework.views import APIView

from .credentials import ensure_known_rows, invalidate
from .models import ApiCredential


def _is_platform_admin(user):
    return user.is_authenticated and user.is_superuser and user.is_staff


def _mask(value):
    value = value or ""
    if not value:
        return ""
    if len(value) <= 8:
        return "•" * len(value)
    return f"{value[:4]}{'•' * 8}{value[-4:]}"


def _row_payload(row):
    return {
        "id": row.id,
        "key": row.key,
        "label": row.label or row.key.replace("_", " ").title(),
        "description": row.description,
        "masked_value": _mask(row.value),
        "has_value": bool((row.value or "").strip()),
        "is_active": row.is_active,
        "updated_at": row.updated_at,
        "updated_by": getattr(row.updated_by, "username", None),
    }


class ApiCredentialListView(APIView):
    """GET /credentials/ — list credentials (values masked)."""

    permission_classes = [IsAuthenticated]

    def get(self, request):
        if not _is_platform_admin(request.user):
            return Response(
                {"error": "Only platform admins can manage credentials."},
                status=status.HTTP_403_FORBIDDEN,
            )
        ensure_known_rows()
        rows = ApiCredential.objects.using("default").all()
        return Response({"credentials": [_row_payload(r) for r in rows]})


class ApiCredentialUpdateView(APIView):
    """PUT /credentials/<pk>/ — update a credential's value / status."""

    permission_classes = [IsAuthenticated]

    def put(self, request, pk):
        if not _is_platform_admin(request.user):
            return Response(
                {"error": "Only platform admins can manage credentials."},
                status=status.HTTP_403_FORBIDDEN,
            )
        try:
            row = ApiCredential.objects.using("default").get(pk=pk)
        except ApiCredential.DoesNotExist:
            return Response(
                {"error": "Credential not found"}, status=status.HTTP_404_NOT_FOUND
            )

        if "value" in request.data:
            row.value = (request.data.get("value") or "").strip()
        if "label" in request.data:
            row.label = (request.data.get("label") or "").strip()
        if "description" in request.data:
            row.description = (request.data.get("description") or "").strip()
        if "is_active" in request.data:
            row.is_active = bool(request.data.get("is_active"))
        row.updated_by = request.user
        row.save(using="default")

        invalidate(row.key)  # next get_credential() reads the fresh value
        return Response(_row_payload(row))