import json
import hashlib
import hmac
from datetime import datetime
from flask import Blueprint, render_template, request, jsonify, current_app, g
from app.extensions import db, csrf

api_bp = Blueprint("api_marketplace", __name__, url_prefix="/api/v1")


class ApiKey(db.Model):
    __tablename__ = "api_keys"
    id = db.Column(db.Integer, primary_key=True)
    user_id = db.Column(db.Integer, db.ForeignKey("users.id"), nullable=False)
    key_hash = db.Column(db.String(128), nullable=False, unique=True)
    name = db.Column(db.String(200), nullable=True)
    permissions = db.Column(db.JSON, default=list)
    rate_limit = db.Column(db.Integer, default=100)
    is_active = db.Column(db.Boolean, default=True)
    created_at = db.Column(db.DateTime, default=datetime.utcnow)
    last_used = db.Column(db.DateTime, nullable=True)
    user = db.relationship("User", backref=db.backref("api_keys", lazy="dynamic"))


def _authenticate_api_key():
    auth = request.headers.get("Authorization", "")
    if not auth.startswith("Bearer "):
        return None
    key = auth[7:]
    key_hash = hashlib.sha256(key.encode()).hexdigest()
    api_key = ApiKey.query.filter_by(key_hash=key_hash, is_active=True).first()
    if api_key:
        api_key.last_used = datetime.utcnow()
        db.session.commit()
    return api_key


@api_bp.before_request
def check_api_auth():
    if request.endpoint and "api_marketplace" in request.endpoint:
        api_key = _authenticate_api_key()
        if not api_key:
            return jsonify({"error": "Invalid or missing API key", "docs": "/api/v1/docs"}), 401
        g.api_user_id = api_key.user_id
        g.api_key = api_key


@api_bp.route("/docs")
@csrf.exempt
def docs():
    return jsonify({
        "name": "Jadwa AI API",
        "version": "1.0",
        "base_url": "/api/v1",
        "authentication": "Bearer token in Authorization header",
        "endpoints": {
            "GET /reports": "List your reports",
            "GET /reports/:id": "Get report details + synthesis data",
            "POST /reports": "Create new feasibility study",
            "GET /reports/:id/export/json": "Export report as JSON",
            "POST /tools/pitch-email": "Generate investor pitch email",
            "POST /tools/brand-kit": "Generate brand kit",
            "POST /tools/investor-match": "Match with investors",
            "POST /tools/scenario": "Financial what-if simulation",
        },
        "rate_limit": "100 requests/hour per API key",
    })


@api_bp.route("/reports", methods=["GET"])
@csrf.exempt
def list_reports():
    from app.models.report import Report
    page = request.args.get("page", 1, type=int)
    per_page = request.args.get("per_page", 20, type=int)
    reports = Report.query.filter_by(user_id=g.api_user_id).order_by(
        Report.created_at.desc()
    ).paginate(page=page, per_page=min(per_page, 50), error_out=False)

    return jsonify({
        "reports": [{
            "id": r.id,
            "project_name": r.project_name,
            "project_description": r.project_description,
            "language": r.language,
            "verdict": r.verdict,
            "created_at": r.created_at.isoformat(),
        } for r in reports.items],
        "total": reports.total,
        "page": page,
        "pages": reports.pages,
    })


@api_bp.route("/reports/<int:report_id>", methods=["GET"])
@csrf.exempt
def get_report(report_id):
    from app.models.report import Report
    report = Report.query.get_or_404(report_id)
    if report.user_id != g.api_user_id:
        return jsonify({"error": "Not found"}), 404

    return jsonify({
        "id": report.id,
        "project_name": report.project_name,
        "project_description": report.project_description,
        "language": report.language,
        "verdict": report.verdict,
        "synthesis": report.synthesis_result,
        "created_at": report.created_at.isoformat(),
    })


@api_bp.route("/reports", methods=["POST"])
@csrf.exempt
def create_report():
    from app.models.report import Report
    from app.ai.diamond import run_diamond, run_sync
    from app.ai.report_generator import generate_report_html
    from app.extensions import sanitize_html

    data = request.get_json() or {}
    name = data.get("project_name", "")
    desc = data.get("project_description", "")
    lang = data.get("language", "en")

    if not name or not desc:
        return jsonify({"error": "project_name and project_description required"}), 400

    report = Report(user_id=g.api_user_id, project_name=name, project_description=desc, language=lang)
    db.session.add(report)
    db.session.commit()

    try:
        result = run_sync(run_diamond(name, desc, lang))
        report.synthesis_result = result.get("synthesis", {})
        report.verdict = result["synthesis"].get("verdict", "")
        report.report_references = result.get("references", [])
        report.full_report_html = sanitize_html(generate_report_html(result["synthesis"], lang, report.report_references))
        db.session.commit()
        return jsonify({"id": report.id, "verdict": report.verdict, "synthesis": report.synthesis_result}), 201
    except Exception as e:
        return jsonify({"error": str(e)}), 500


@api_bp.route("/reports/<int:report_id>/export/json", methods=["GET"])
@csrf.exempt
def export_json(report_id):
    from app.models.report import Report
    report = Report.query.get_or_404(report_id)
    if report.user_id != g.api_user_id:
        return jsonify({"error": "Not found"}), 404
    return jsonify(report.synthesis_result or {})