"""认证 API — 对接 MOM sys_user + 双 Token 刷新"""
from fastapi import APIRouter, Depends, Request
from app.schemas.user import (
    LoginRequest,
    LoginResponse,
    RefreshRequest,
    RefreshResponse,
    UserResponse,
)
from app.services.auth_service import login, refresh_access_token, get_current_user

router = APIRouter(prefix="/auth", tags=["认证"])


@router.post("/login", response_model=LoginResponse)
def login_endpoint(data: LoginRequest, request: Request):
    """登录 — 验证 MOM sys_user 表，返回 Access + Refresh 双 Token"""
    # 登录请求本身尚未认证，中间件拿不到操作人。但「谁在尝试登录、失败了多少次」
    # 恰恰是审计里最该有的信息，所以在校验之前就把尝试的账号写进 state：
    # 登录失败时同样留痕，且能按账号追踪暴力破解。
    # 注意：绝不把 data.password 写进 state / 审计，密码不落库。
    request.state.audit_user = data.username
    return login(data.username, data.password)


@router.post("/refresh", response_model=RefreshResponse)
def refresh_endpoint(data: RefreshRequest):
    """刷新 Access Token — 使用 Refresh Token 换取新的 Access Token"""
    return refresh_access_token(data.refresh_token)


@router.get("/me", response_model=UserResponse)
def get_me(current_user: dict = Depends(get_current_user)):
    """获取当前用户信息（从 Access Token 解析）"""
    return UserResponse(
        id=current_user["sub"],
        username=current_user.get("username", ""),
        display_name=current_user.get("display_name", ""),
        role=current_user.get("role", "operator"),
    )