"""
FastAPI dependencies for shared request validation (exported repositories, etc.).
"""

from __future__ import annotations

import ipaddress
from typing import Annotated, Any

from fastapi import Depends, Form, HTTPException, Query, Request
from pygittools.validation import is_valid_project

from pygitweb.auth import (
    access_token_from_request,
    ensure_read_project,
    ensure_write_project,
)
from pygitweb.config import settings
from pygitweb.projects import git_get_projects_list, project_in_list


def _visible_projects_list() -> list[dict[str, Any]]:
    return git_get_projects_list(
        filter_path="",
        paranoid=settings.STRICT_EXPORT,
        export_ok=settings.EXPORT_OK,
    )


def project_visible_in_list(project: str) -> bool:
    """True if ``project`` appears in the same listing as the project picker."""
    return project_in_list(project, _visible_projects_list)


def require_valid_project(project: str) -> str:
    """Reject empty or unknown project paths (export_ok, strict list, etc.)."""
    if not project or project == "":
        raise HTTPException(status_code=400, detail="Project needed")
    if not is_valid_project(
        project,
        settings.PROJECTROOT,
        settings.EXPORT_OK,
        settings.STRICT_EXPORT,
        project_visible_in_list,
    ):
        raise HTTPException(status_code=404, detail="No such project")
    return project


def require_valid_project_name(name: str) -> str:
    """Same as ``require_valid_project`` for a path parameter named ``name``."""
    return require_valid_project(name)


def require_valid_project_from_query(
    project: Annotated[str, Query(..., description="Project path")],
) -> str:
    return require_valid_project(project)


def require_valid_project_form(project: Annotated[str, Form()]) -> str:
    return require_valid_project(project)


def require_readable_project(
    project: str,
    token: Annotated[str | None, Depends(access_token_from_request)],
) -> str:
    validated = require_valid_project(project)
    ensure_read_project(validated, token)
    return validated


def require_readable_project_from_query(
    project: Annotated[str, Query(..., description="Project path")],
    token: Annotated[str | None, Depends(access_token_from_request)],
) -> str:
    return require_readable_project(project, token)


def require_readable_project_form(
    project: Annotated[str, Form()],
    token: Annotated[str | None, Depends(access_token_from_request)],
) -> str:
    return require_readable_project(project, token)


def require_readable_project_name(
    name: str,
    token: Annotated[str | None, Depends(access_token_from_request)],
) -> str:
    return require_readable_project(name, token)


def require_writable_project_name(
    name: str,
    token: Annotated[str | None, Depends(access_token_from_request)],
) -> str:
    validated = require_valid_project(name)
    ensure_write_project(validated, token)
    return validated


def is_loopback_host(host: str | None) -> bool:
    if not host:
        return False
    if host == "localhost":
        return True
    try:
        return ipaddress.ip_address(host).is_loopback
    except ValueError:
        return False


def require_loopback_client(request: Request) -> None:
    """Reject non-local callers (hooks should POST from the same host)."""
    client = request.client
    if client is not None and is_loopback_host(client.host):
        return
    raise HTTPException(status_code=403, detail="Forbidden")


def require_notify_project(
    project: Annotated[str | None, Query(alias="project", description="Repository path")] = None,
) -> str:
    """Internal notify: project must appear in the visible list (hook / long-poll contract)."""
    if not project or not project.strip():
        raise HTTPException(status_code=400, detail="project query parameter required")
    p = project.strip()
    if not project_visible_in_list(p):
        raise HTTPException(status_code=404, detail="No such project")
    return p


def board_create_resolved_project(
    token: Annotated[str | None, Depends(access_token_from_request)],
    p: Annotated[str | None, Query(alias="p")] = None,
    project: Annotated[str | None, Query(alias="project")] = None,
) -> str:
    """Resolve ``?p=`` / ``?project=`` then validate as a normal project path."""
    chosen = (project or p or "").strip()
    if not chosen:
        raise HTTPException(status_code=400, detail="Project needed (use ?project= or ?p=)")
    return require_readable_project(chosen, token)


def filter_projects_by_read_access(
    projects: list[dict[str, Any]],
    token: str | None,
) -> list[dict[str, Any]]:
    from pygitweb.auth import can_read_project

    return [p for p in projects if can_read_project(p.get("path", ""), token)]


ValidatedPathProject = Annotated[str, Depends(require_valid_project)]
ValidatedReadableProject = Annotated[str, Depends(require_readable_project)]
ValidatedQueryProject = Annotated[str, Depends(require_valid_project_from_query)]
ValidatedReadableQueryProject = Annotated[str, Depends(require_readable_project_from_query)]
ValidatedSettingsProject = Annotated[str, Depends(require_valid_project_name)]
ValidatedReadableSettingsProject = Annotated[str, Depends(require_readable_project_name)]
ValidatedWritableSettingsProject = Annotated[str, Depends(require_writable_project_name)]
ValidatedBoardCreateProject = Annotated[str, Depends(board_create_resolved_project)]
ValidatedNotifyProject = Annotated[str, Depends(require_notify_project)]
ValidatedFormProject = Annotated[str, Depends(require_valid_project_form)]
ValidatedReadableFormProject = Annotated[str, Depends(require_readable_project_form)]