from fastapi import Depends, HTTPException, status
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.database import get_db
from app.core.security import decode_token
from app.models.user import User

bearer = HTTPBearer()

async def get_current_user(
    credentials: HTTPAuthorizationCredentials = Depends(bearer),
    db: AsyncSession = Depends(get_db),
):
    try:
        payload = decode_token(credentials.credentials)
        if payload.get("token_type") != "access":
            raise ValueError()
        user_id = int(payload["user_id"])
    except Exception:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token")
    user = await db.scalar(select(User).where(User.id == user_id, User.status == "active"))
    if not user:
        raise HTTPException(status_code=401, detail="User not found")
    return user

async def get_current_brand(user=Depends(get_current_user)):
    return user.brand_id

def require_permission(permission_code: str):
    async def checker(user=Depends(get_current_user), db: AsyncSession = Depends(get_db)):
        from app.models.role import Role
        from app.models.permission import Permission
        from app.models.role import role_permissions
        q = await db.scalar(
            select(Permission).join(role_permissions, Permission.id == role_permissions.c.permission_id)
            .join(Role, Role.id == role_permissions.c.role_id)
            .where(Role.id == user.role_id, Permission.code == permission_code)
        )
        if not q:
            raise HTTPException(status_code=403, detail="Permission denied")
        return user
    return checker