"""GET /v1/user_info — service-token authenticated user info endpoint."""

from __future__ import annotations

import json
import logging

from fastapi import APIRouter, Depends, HTTPException, status

from app.core.auth import AuthContext, require_read
from app.core.config import Settings, get_settings
from app.core.encryption import InvalidToken, decrypt_payload
from app.repositories.factory import get_portfolio_repository_from_settings
from app.schemas.v1 import BrokerItem, UserInfoResponse

logger = logging.getLogger(__name__)
router = APIRouter(prefix="/v1", tags=["v1"])


def _require_service_token(auth: AuthContext = Depends(require_read)) -> AuthContext:
    if auth.token_source != "db" or auth.token_type != "service":
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Service token required",
        )
    return auth


@router.get("/user_info", response_model=UserInfoResponse)
def get_user_info(
    auth: AuthContext = Depends(_require_service_token),
    settings: Settings = Depends(get_settings),
) -> UserInfoResponse:
    # REQ-049, REQ-051: daemon_id 없으면 403 (daemon-scoped 인가 규율)
    if auth.daemon_id is None:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="daemon_id binding required",
        )

    repo = get_portfolio_repository_from_settings(settings)
    try:
        user = repo.get_user(auth.user_id)  # type: ignore[arg-type]

        # REQ-049: daemon_id로 단일 broker 인증정보 조회 및 복호화
        broker_item: BrokerItem | None = None
        try:
            credentials = repo.list_broker_credentials(  # type: ignore[call-arg]
                auth.user_id,  # type: ignore[arg-type]
                daemon_id=auth.daemon_id,
            )
            if credentials:
                cred = credentials[0]
                credential_payload = None
                try:
                    enc_key = settings.require_credential_encryption_key()
                    raw = decrypt_payload(enc_key, cred.encrypted_payload)
                    credential_payload = json.loads(raw)
                except (InvalidToken, RuntimeError, Exception) as exc:
                    # REQ-051 AC-8: 로그에 app_key, app_secret 값 미포함
                    # exc는 Fernet 토큰 오류 메시지만 포함하며 credential 값을 담지 않는다.
                    logger.warning(
                        "credential decryption failed for broker %s daemon %s: %s",
                        cred.broker,
                        auth.daemon_id,
                        type(exc).__name__,
                    )
                broker_item = BrokerItem(
                    broker=cred.broker,
                    account_ref=cred.account_ref,
                    credential_payload=credential_payload,
                    credential_version=cred.credential_version,
                    last_rotated_at=cred.last_rotated_at,
                )
        except AttributeError:
            # repo does not implement list_broker_credentials yet (mock or older impl)
            pass
        except Exception as exc:  # pragma: no cover - defensive
            # REQ-049, REQ-051: broker 인증정보 조회 실패는 broker=null로 graceful degrade.
            # daemon_id, trading_enabled 필수 필드는 영향 없음.
            logger.warning(
                "broker credential lookup failed for daemon %s; returning broker=null: %s",
                auth.daemon_id,
                type(exc).__name__,
            )
            broker_item = None

    finally:
        if callable(getattr(type(repo), "close", None)):
            repo.close()

    disabled_reason: str | None = None
    if not user.is_active:
        disabled_reason = "account_inactive"

    return UserInfoResponse(
        runtime_id=auth.runtime_id,
        daemon_id=auth.daemon_id,
        trading_enabled=user.is_active,
        disabled_reason=disabled_reason,
        broker=broker_item,
        user_id=user.id,
        username=user.username,
        email=user.email,
        permission=user.permission,
    )