"""
Admin API endpoints for audit log queries.

Loi 25 compliance: allows administrators to review access and auth logs.
"""

from flask import Blueprint, request, jsonify

from src.services.audit import get_access_logs, get_auth_logs, is_audit_enabled
from src.utils import admin_required

audit_bp = Blueprint('audit', __name__)


@audit_bp.route('/api/admin/audit/status', methods=['GET'])
@admin_required
def audit_status():
    """Check if audit logging is enabled."""
    return jsonify({'enabled': is_audit_enabled()})


@audit_bp.route('/api/admin/audit/access', methods=['GET'])
@admin_required
def list_access_logs():
    """List access logs with pagination and filters."""
    page = request.args.get('page', 1, type=int)
    per_page = min(request.args.get('per_page', 50, type=int), 200)
    user_id = request.args.get('user_id', type=int)
    resource_type = request.args.get('resource_type')
    resource_id = request.args.get('resource_id', type=int)
    action = request.args.get('action')

    result = get_access_logs(
        page=page, per_page=per_page,
        user_id=user_id, resource_type=resource_type,
        resource_id=resource_id, action=action,
    )

    return jsonify({
        'logs': [log.to_dict() for log in result.items],
        'total': result.total,
        'page': result.page,
        'per_page': per_page,
        'pages': result.pages,
    })


@audit_bp.route('/api/admin/audit/auth', methods=['GET'])
@admin_required
def list_auth_logs():
    """List authentication logs with pagination and filters."""
    page = request.args.get('page', 1, type=int)
    per_page = min(request.args.get('per_page', 50, type=int), 200)
    user_id = request.args.get('user_id', type=int)
    action = request.args.get('action')

    result = get_auth_logs(page=page, per_page=per_page, user_id=user_id, action=action)

    return jsonify({
        'logs': [log.to_dict() for log in result.items],
        'total': result.total,
        'page': result.page,
        'per_page': per_page,
        'pages': result.pages,
    })


@audit_bp.route('/api/admin/audit/recording/<int:recording_id>', methods=['GET'])
@admin_required
def recording_access_logs(recording_id):
    """Get all access logs for a specific recording."""
    page = request.args.get('page', 1, type=int)
    per_page = min(request.args.get('per_page', 50, type=int), 200)

    result = get_access_logs(page=page, per_page=per_page, resource_type='recording', resource_id=recording_id)

    return jsonify({
        'logs': [log.to_dict() for log in result.items],
        'total': result.total,
        'page': result.page,
        'per_page': per_page,
        'pages': result.pages,
    })


@audit_bp.route('/api/admin/audit/user/<int:user_id>', methods=['GET'])
@admin_required
def user_audit_logs(user_id):
    """Get all audit logs (access + auth) for a specific user."""
    page = request.args.get('page', 1, type=int)
    per_page = min(request.args.get('per_page', 50, type=int), 200)

    access_result = get_access_logs(page=page, per_page=per_page, user_id=user_id)
    auth_result = get_auth_logs(page=page, per_page=per_page, user_id=user_id)

    return jsonify({
        'access_logs': {
            'logs': [log.to_dict() for log in access_result.items],
            'total': access_result.total,
        },
        'auth_logs': {
            'logs': [log.to_dict() for log in auth_result.items],
            'total': auth_result.total,
        },
        'page': page,
        'per_page': per_page,
    })
