"""Flask CLI commands."""

import click
from flask.cli import with_appcontext


@click.group('db-utils')
def db_cli():
    """Database utility commands."""
    pass


@db_cli.command('seed-state')
@with_appcontext
def seed_state():
    """Report whether the seed data a working install depends on is present.

    A server whose seeds never ran does not fail politely: settings endpoints
    answer 404 for keys that were never created and most pages answer 500, which
    reads as a broken application rather than an unfinished install. This gives
    the operator console something definite to test, so it can say "run repair"
    instead of leaving somebody to infer it from unrelated errors.

    Prints one line per group and exits non-zero if anything is missing, so it
    can be used as a gate as well as read by a person.
    """
    import sys
    from shopdb.extensions import db
    from sqlalchemy import text

    # Sentinels, not exhaustive counts. Each is created by one of the three seed
    # commands, so a zero here means that command never ran.
    checks = [
        ('permissions',    'SELECT COUNT(*) FROM permissions',   'flask seed permissions'),
        ('settings',       'SELECT COUNT(*) FROM settings',      'flask seed settings'),
        ('asset types',    'SELECT COUNT(*) FROM assettypes',    'flask seed reference-data'),
        ('location types', 'SELECT COUNT(*) FROM locationtypes', 'flask seed reference-data'),
    ]

    missing = []
    for label, sql, remedy in checks:
        try:
            count = db.session.execute(text(sql)).scalar() or 0
        except Exception as exc:
            click.echo(click.style('  MISSING ', fg='red') +
                       '%s - table unreadable (%s)' % (label, type(exc).__name__))
            missing.append((label, remedy))
            continue
        if count == 0:
            click.echo(click.style('  MISSING ', fg='red') +
                       '%s - none present, run: %s' % (label, remedy))
            missing.append((label, remedy))
        else:
            click.echo(click.style('  OK      ', fg='green') + '%s (%d)' % (label, count))

    if missing:
        click.echo('')
        click.echo(click.style('%d group(s) missing. This server is not fully provisioned.'
                               % len(missing), fg='red'))
        sys.exit(1)
    click.echo('')
    click.echo(click.style('Seed data present.', fg='green'))


@db_cli.command('create-all')
@with_appcontext
def create_all():
    """Create all database tables."""
    from shopdb.extensions import db

    db.create_all()
    click.echo(click.style("All tables created.", fg='green'))


@db_cli.command('preflight')
@with_appcontext
def preflight():
    """Check install prerequisites before `flask db upgrade`.

    Reports what must be fixed/installed (Python, required env, DB connectivity,
    and the MySQL 5.6 utf8mb4 index flags). Exits non-zero if anything blocks.
    """
    import sys
    import os
    from sqlalchemy import text
    from flask import current_app
    from shopdb.extensions import db

    failures = []
    warnings = []

    def ok(msg):
        click.echo(click.style('  PASS ', fg='green') + msg)

    def fail(msg, fix):
        failures.append((msg, fix))
        click.echo(click.style('  FAIL ', fg='red') + msg)
        click.echo(click.style('       fix: ', fg='red') + fix)

    def warn(msg, fix):
        warnings.append((msg, fix))
        click.echo(click.style('  WARN ', fg='yellow') + msg)
        click.echo(click.style('       ', fg='yellow') + fix)

    click.echo(click.style('ShopDB preflight', bold=True))

    # Python
    py = sys.version_info
    if py >= (3, 9):
        ok(f'Python {py.major}.{py.minor}.{py.micro}')
    else:
        fail(f'Python {py.major}.{py.minor} is too old',
             'Install Python 3.9 or newer.')

    # Required config
    for key in ('SECRET_KEY', 'JWT_SECRET_KEY', 'DATABASE_URL'):
        value = current_app.config.get(key) or os.environ.get(key)
        if value and 'change' not in str(value).lower() and 'dev-' not in str(value).lower():
            ok(f'{key} is set')
        else:
            fail(f'{key} is missing or a dev default',
                 f'Set {key} in .env (64+ random chars for the secrets).')

    # DB connectivity + MySQL index prerequisites
    try:
        version = db.session.execute(text('SELECT VERSION()')).scalar()
        ok(f'Database reachable (MySQL {version})')
    except Exception as exc:
        fail('Cannot connect to the database', f'Check DATABASE_URL / server. ({exc})')
        version = ''

    if version and version.startswith('5.6'):
        variables = {}
        for name in ('innodb_large_prefix', 'innodb_file_format', 'innodb_file_per_table'):
            try:
                row = db.session.execute(text(f"SHOW VARIABLES LIKE '{name}'")).fetchone()
                variables[name] = row[1] if row else None
            except Exception:
                variables[name] = None
        needed = {'innodb_large_prefix': 'ON', 'innodb_file_format': 'Barracuda',
                  'innodb_file_per_table': 'ON'}
        bad = [n for n, want in needed.items() if str(variables.get(n)).lower() != want.lower()]
        if bad:
            fail('MySQL 5.6 index flags not set: ' + ', '.join(bad),
                 'Add to my.cnf [mysqld]: innodb_file_per_table=1, '
                 'innodb_file_format=Barracuda, innodb_large_prefix=1 (then restart). '
                 'Otherwise `flask db upgrade` fails with error 1071.')
        else:
            ok('MySQL 5.6 index flags OK (Barracuda + large_prefix)')
    elif version:
        ok('MySQL 5.7+/8.0 - no extra index flags needed')

    # The database's own default charset. Tables are forced to utf8mb4 by the
    # compiler hook (shopdb/utils/mysql_charset.py), so a latin1 default does not
    # break the schema - but anything created OUTSIDE that path inherits it, and
    # a database created without an explicit CHARSET is the usual cause. Cheap to
    # check here, invisible until characters come back mangled.
    if version:
        try:
            row = db.session.execute(text(
                'SELECT DEFAULT_CHARACTER_SET_NAME FROM information_schema.SCHEMATA '
                'WHERE SCHEMA_NAME = DATABASE()')).fetchone()
            charset = row[0] if row else None
            if charset is None:
                warn('Could not read the database default charset',
                     'Not fatal - tables are forced to utf8mb4 regardless.')
            elif str(charset).lower() == 'utf8mb4':
                ok('Database default charset is utf8mb4')
            else:
                warn(f'Database default charset is {charset}, not utf8mb4',
                     'Tables this application creates are forced to utf8mb4, so the '
                     'schema is correct. Fix the default so anything created outside '
                     'the migrations matches: ALTER DATABASE <name> CHARACTER SET '
                     'utf8mb4 COLLATE utf8mb4_unicode_ci;')
        except Exception as exc:
            warn('Could not read the database default charset', f'({exc})')

    click.echo('')
    if failures:
        click.echo(click.style(f'{len(failures)} blocker(s). Fix them before installing.', fg='red', bold=True))
        raise SystemExit(1)
    click.echo(click.style('All prerequisites met.' + (f' ({len(warnings)} warning(s))' if warnings else ''), fg='green', bold=True))


@db_cli.command('drop-all')
@click.confirmation_option(prompt='This will delete ALL data. Are you sure?')
@with_appcontext
def drop_all():
    """Drop all database tables."""
    from shopdb.extensions import db

    db.drop_all()
    click.echo(click.style("All tables dropped.", fg='yellow'))


@click.group('seed')
def seed_cli():
    """Database seeding commands."""
    pass


@seed_cli.command('catalog')
@click.option('--file', 'path', default=None,
              help='catalog JSON to load (default shopdb/data/catalog.json)')
@click.option('--dry-run', is_flag=True, help='report what would be added, write nothing')
@with_appcontext
def seed_catalog(path, dry_run):
    """Load the shared vendor/model catalog shipped with the product.

    `seed reference-data` writes a dozen generic model types and no vendors or
    models, so every new site began by retyping a catalog another site had
    already built. This loads that catalog instead.

    IDEMPOTENT and ADDITIVE. Records are matched by natural key - a vendor by
    name, a model by vendor plus model number, a type by its name - so running
    it twice adds nothing the second time. It never updates or deletes an
    existing record: a site that has corrected a description or pointed a model
    at its own photo keeps its version.

    Catalog only. Nothing here identifies a site: no assets, locations,
    employees or serial numbers.
    """
    import json
    import os
    from shopdb.extensions import db
    from shopdb.core.models import ModelType, OperatingSystem, LocationType, Vendor, Model

    if not path:
        path = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
                            'data', 'catalog.json')
    if not os.path.isfile(path):
        click.echo(click.style('No catalog file at %s' % path, fg='red'))
        raise SystemExit(1)

    with open(path, encoding='utf-8') as handle:
        data = json.load(handle)

    added = {}

    def note(kind, count):
        if count:
            added[kind] = added.get(kind, 0) + count

    def simple(key, model, column):
        """Type vocabularies: one row per name."""
        records = data.get(key) or []
        count = 0
        for record in records:
            name = record.get(column)
            if not name:
                continue
            if db.session.query(model).filter_by(**{column: name}).first():
                continue
            db.session.add(model(**{k: v for k, v in record.items()
                                    if hasattr(model, k)}))
            count += 1
        note(key, count)

    simple('modeltypes', ModelType, 'modeltype')
    simple('locationtypes', LocationType, 'locationtype')
    simple('operatingsystems', OperatingSystem, 'osname')

    # Per-plugin type tables exist only where that plugin is installed, so they
    # are loaded through the ORM registry rather than imported directly - a lean
    # build without printers must not fail here.
    plugin_types = [
        ('machinetypes', 'machinetype'),
        ('computertypes', 'computertype'),
        ('printertypes', 'printertype'),
        ('networkdevicetypes', 'networkdevicetype'),
    ]
    by_table = {m.class_.__tablename__: m.class_ for m in db.Model.registry.mappers}
    for key, column in plugin_types:
        model = by_table.get(key)
        if model is None:
            continue
        simple(key, model, column)

    # Vendors before models, since a model resolves its vendor by name.
    count = 0
    for record in data.get('vendors') or []:
        name = record.get('vendor')
        if not name or Vendor.query.filter_by(vendor=name).first():
            continue
        db.session.add(Vendor(**{k: v for k, v in record.items() if hasattr(Vendor, k)}))
        count += 1
    note('vendors', count)
    db.session.flush()

    vendor_ids = {v.vendor: v.vendorid for v in Vendor.query.all()}
    modeltype_ids = {m.modeltype: m.modeltypeid for m in ModelType.query.all()}

    count = 0
    skipped_vendor = 0
    for record in data.get('models') or []:
        modelnumber = record.get('modelnumber')
        if not modelnumber:
            continue
        vendorid = vendor_ids.get(record.get('vendor'))
        # The catalog's unique key is model number PLUS vendor, so the same
        # number from two makers stays two records.
        if Model.query.filter_by(modelnumber=modelnumber, vendorid=vendorid).first():
            continue
        if record.get('vendor') and vendorid is None:
            skipped_vendor += 1
            continue
        db.session.add(Model(
            modelnumber=modelnumber,
            vendorid=vendorid,
            modeltypeid=modeltype_ids.get(record.get('modeltype')),
            description=record.get('description'),
            documentationurl=record.get('documentationurl'),
            imageurl=record.get('imageurl'),
        ))
        count += 1
    note('models', count)

    # Small plugin vocabularies, loaded through the registry so a lean build
    # missing that plugin skips them instead of failing to import.
    for key, model_table, column in (('measuringtooltypes', 'measuringtooltypes', 'name'),
                                     ('notificationtypes', 'notificationtypes', 'typename'),
                                     ('accessprotocols', 'accessprotocols', 'name')):
        model = by_table.get(model_table)
        if model is not None:
            simple(key, model, column)

    # Printer supplies. Resolved against the models loaded above, by the model's
    # natural key - part numbers are useless attached to the wrong printer.
    supply_model = by_table.get('modelsupplies')
    if supply_model is not None and (data.get('modelsupplies') or []):
        db.session.flush()
        model_key = {}
        for m in Model.query.all():
            model_key[(m.modelnumber, m.vendorid)] = m.modelnumberid
        vendor_ids = {v.vendor: v.vendorid for v in Vendor.query.all()}

        count = 0
        orphaned = 0
        for record in data['modelsupplies']:
            partnumber = record.get('partnumber')
            modelnumber = record.get('modelnumber')
            if not partnumber or not modelnumber:
                continue
            modelnumberid = model_key.get((modelnumber, vendor_ids.get(record.get('vendor'))))
            if modelnumberid is None:
                orphaned += 1
                continue
            if db.session.query(supply_model).filter_by(
                    modelnumberid=modelnumberid, partnumber=partnumber).first():
                continue
            db.session.add(supply_model(
                modelnumberid=modelnumberid,
                supplytype=record.get('supplytype') or 'toner',
                color=record.get('color') or 'none',
                capacitytier=record.get('capacitytier') or 'standard',
                partnumber=partnumber,
                marketingname=record.get('marketingname'),
                pageyield=record.get('pageyield'),
                notes=record.get('notes'),
            ))
            count += 1
        note('modelsupplies', count)
        if orphaned:
            click.echo(click.style('  %d supply record(s) skipped: their model is not in this catalog'
                                   % orphaned, fg='yellow'))

    if dry_run:
        db.session.rollback()
        click.echo(click.style('DRY RUN - nothing written.', fg='yellow'))
    else:
        db.session.commit()

    if not added:
        click.echo(click.style('Catalog already present, nothing to add.', fg='green'))
    else:
        for kind in sorted(added):
            click.echo('  %-22s +%d' % (kind, added[kind]))
        click.echo('')
        click.echo(click.style('Catalog loaded from %s' % os.path.basename(path), fg='green'))
    if skipped_vendor:
        click.echo(click.style('  %d model(s) skipped: their vendor is not in this catalog'
                               % skipped_vendor, fg='yellow'))


@seed_cli.command('reference-data')
@with_appcontext
def seed_reference_data():
    """Seed reference data (model types, statuses, etc.)."""
    from shopdb.extensions import db
    from shopdb.core.models import (ModelType, OperatingSystem, AssetStatus,
                                     LocationType, CommunicationType)
    from shopdb.core.models.relationship import RelationshipType

    # Model types (type the vendor models catalog)
    model_types = [
        {'modeltype': 'CNC Mill', 'category': 'Equipment', 'description': 'CNC Milling Machine'},
        {'modeltype': 'CNC Lathe', 'category': 'Equipment', 'description': 'CNC Lathe'},
        {'modeltype': 'CMM', 'category': 'Equipment', 'description': 'Coordinate Measuring Machine'},
        {'modeltype': 'EDM', 'category': 'Equipment', 'description': 'Electrical Discharge Machine'},
        {'modeltype': 'Grinder', 'category': 'Equipment', 'description': 'Grinding Machine'},
        {'modeltype': 'Inspection Station', 'category': 'Equipment', 'description': 'Inspection Station'},
        {'modeltype': 'Desktop PC', 'category': 'PC', 'description': 'Desktop Computer'},
        {'modeltype': 'Laptop', 'category': 'PC', 'description': 'Laptop Computer'},
        {'modeltype': 'Shopfloor PC', 'category': 'PC', 'description': 'Shopfloor Computer'},
        {'modeltype': 'Server', 'category': 'Network', 'description': 'Server'},
        {'modeltype': 'Switch', 'category': 'Network', 'description': 'Network Switch'},
        {'modeltype': 'Access Point', 'category': 'Network', 'description': 'Wireless Access Point'},
    ]

    for mt_data in model_types:
        existing = ModelType.query.filter_by(modeltype=mt_data['modeltype']).first()
        if not existing:
            mt = ModelType(**mt_data)
            db.session.add(mt)

    # Asset statuses (canonical set - the asset model is the contract)
    asset_statuses = [
        {'status': 'In Use', 'description': 'Currently in use', 'color': '#28a745'},
        {'status': 'Inventory', 'description': 'In inventory', 'color': '#17a2b8'},
        {'status': 'In Repair', 'description': 'Being repaired', 'color': '#ffc107'},
        {'status': 'Retired', 'description': 'No longer in use', 'color': '#6c757d'},
        {'status': 'Returned', 'description': 'Returned to vendor or owner', 'color': '#fd7e14'},
        {'status': 'Warrantied', 'description': 'Under warranty service', 'color': '#20c997'},
        {'status': 'Lost', 'description': 'Lost or missing', 'color': '#dc3545'},
    ]

    for s_data in asset_statuses:
        existing = AssetStatus.query.filter_by(status=s_data['status']).first()
        if not existing:
            db.session.add(AssetStatus(isactive=True, **s_data))
        elif existing.isactive is not True:
            existing.isactive = True

    # Location types (ADR-001)
    location_types = ['section', 'cell', 'subcell', 'operation', 'meetingroom',
                      'lab', 'office', 'storage', 'hallway', 'networkcloset',
                      'building']
    for lt in location_types:
        if not LocationType.query.filter_by(locationtype=lt).first():
            db.session.add(LocationType(locationtype=lt, isactive=True))

    # Communication types (how an asset is reached / its interfaces). The IP
    # type is what the printer + network create routes attach an ipaddress to,
    # so it must exist before any asset import.
    comm_types = [
        ('IP', 'IP address / network reachable'),
        ('Serial', 'Serial (RS-232) connection'),
        ('Network_Interface', 'Physical network interface (MAC/port)'),
        ('USB', 'USB connection'),
        ('Parallel', 'Parallel port connection'),
        ('VNC', 'VNC remote access'),
        ('FTP', 'FTP file transfer'),
        ('DNC', 'Direct numerical control link'),
    ]
    for comtype, description in comm_types:
        if not CommunicationType.query.filter_by(comtype=comtype).first():
            db.session.add(CommunicationType(comtype=comtype, description=description))

    # Operating systems
    os_list = [
        {'osname': 'Windows 10', 'osversion': '10.0'},
        {'osname': 'Windows 11', 'osversion': '11.0'},
        {'osname': 'Windows Server 2019', 'osversion': '2019'},
        {'osname': 'Windows Server 2022', 'osversion': '2022'},
        {'osname': 'Linux', 'osversion': 'Various'},
    ]

    for os_data in os_list:
        existing = OperatingSystem.query.filter_by(osname=os_data['osname']).first()
        if not existing:
            os_obj = OperatingSystem(**os_data)
            db.session.add(os_obj)

    # Connection types (pre-1.0 legacy; kept for backward compat with
    # existing relationship rows. New ADR-001 code reasons about the three
    # canonical types below via free-text label.)
    # all symmetric physical/network links -> isdirectional=False so the
    # relationships card shows one direction-blind "connected" entry per peer.
    connection_types = [
        {'relationshiptype': 'Serial Cable', 'description': 'RS-232 or similar serial connection', 'isdirectional': False},
        {'relationshiptype': 'Direct Ethernet', 'description': 'Direct network cable (airgapped)', 'isdirectional': False},
        {'relationshiptype': 'USB', 'description': 'USB connection', 'isdirectional': False},
        {'relationshiptype': 'WiFi', 'description': 'Wireless network connection', 'isdirectional': False},
        {'relationshiptype': 'Dualpath', 'description': 'Redundant/failover network path', 'isdirectional': False},
    ]

    for ct_data in connection_types:
        existing = RelationshipType.query.filter_by(relationshiptype=ct_data['relationshiptype']).first()
        if not existing:
            ct = RelationshipType(**ct_data)
            db.session.add(ct)

    # ADR-001 canonical relationship types. Created first, then their
    # propagation rails are seeded as relationshiptypepropagations rows (M:N).
    # All idempotent.
    #
    # MySQL collation is case-insensitive by default, which would let a
    # legacy capitalized row (e.g. "Controls") match the lowercase
    # "controls" check and skip the insert. Force binary comparison via
    # collate so the three ADR-001 types stay distinct from any legacy
    # rows with the same spelling but different case.
    from sqlalchemy import func, literal
    def _lookup_binary(name):
        dialect = db.engine.dialect.name
        if dialect == 'mysql':
            return RelationshipType.query.filter(
                func.binary(RelationshipType.relationshiptype) == literal(name)
            ).first()
        return RelationshipType.query.filter_by(relationshiptype=name).first()

    adr_types = [
        {'relationshiptype': 'partof', 'description': 'Composition / sub-assembly (ADR-001)', 'isdirectional': True},
        {'relationshiptype': 'controls', 'description': 'Operational authority over another asset (ADR-001)', 'isdirectional': True},
        {'relationshiptype': 'connectedto', 'description': 'Network or data link without authority (ADR-001)', 'isdirectional': False},
    ]
    for at in adr_types:
        if not _lookup_binary(at['relationshiptype']):
            db.session.add(RelationshipType(**at))

    # Printer assignment edges. usesprinter = "this printer is installed here",
    # defaultprinter = which of them is the default. Assignment lives on the
    # MACHINE asset and reaches whichever PC controls it through the controls
    # rail seeded below, so a reimaged PC gets its printers back with no
    # restore step. Created before the rails: _seed_propagation no-ops in
    # silence when either type is missing.
    printer_types = [
        {'relationshiptype': 'usesprinter',
         'description': 'Asset to a printer installed on it (ADR-001)',
         'isdirectional': True},
        {'relationshiptype': 'defaultprinter',
         'description': 'PC to its default printer (installer preselect, ADR-001)',
         'isdirectional': True,
         # One default per asset. The unique constraint is (source, target,
         # type), so two DIFFERENT defaults are two valid rows and the resolver
         # then takes the oldest - the new default silently loses. Core's
         # create path replaces instead, driven by this flag.
         'issingular': True},
    ]
    for pt in printer_types:
        existing = _lookup_binary(pt['relationshiptype'])
        if not existing:
            db.session.add(RelationshipType(**pt))
        elif pt.get('issingular') and not existing.issingular:
            # A site seeded before the flag existed keeps its row and gains the
            # rule; without this the upgrade leaves the old silent behaviour.
            existing.issingular = True
    db.session.flush()

    # Seed propagation rails as M:N rows. controls -> partof (declared;
    # directional rail, not consumed yet) and controls -> Dualpath (consumed;
    # a dual-bay pair shares one controller so both bays carry controls).
    # The two printer rails are READ-TIME only: the create-time fan-out skips
    # directional through-types, and controls is directional, so a PC's own
    # rows keep beating what it inherits from the machine it controls.
    # Idempotent, resolved by name, skipped if a type is missing.
    from shopdb.core.models.relationship import RelationshipTypePropagation

    def _seed_propagation(sourcename, throughname):
        source = _lookup_binary(sourcename)
        through = _lookup_binary(throughname)
        if not source or not through:
            return
        exists = RelationshipTypePropagation.query.filter_by(
            relationshiptypeid=source.relationshiptypeid,
            throughtypeid=through.relationshiptypeid,
        ).first()
        if not exists:
            db.session.add(RelationshipTypePropagation(
                relationshiptypeid=source.relationshiptypeid,
                throughtypeid=through.relationshiptypeid,
            ))

    _seed_propagation('controls', 'partof')
    _seed_propagation('controls', 'Dualpath')
    _seed_propagation('usesprinter', 'controls')
    _seed_propagation('defaultprinter', 'controls')

    db.session.commit()
    click.echo(click.style("Reference data seeded.", fg='green'))


@seed_cli.command('test-user')
@with_appcontext
def seed_test_user():
    """Create a test admin user (admin / admin123). DEV ONLY."""
    from flask import current_app
    from shopdb.extensions import db
    from shopdb.core.models import User, Role
    from werkzeug.security import generate_password_hash

    # Refuse in production: this seeds a well-known credential. Sites bootstrap
    # a real admin with `flask seed admin` (generated password) or the wizard.
    if not (current_app.config.get('DEBUG') or current_app.config.get('TESTING')):
        raise click.ClickException(
            'seed test-user is dev-only (creates admin/admin123). '
            'Use `flask seed admin` to create a production admin.')

    # Create admin role if not exists
    admin_role = Role.query.filter_by(rolename='admin').first()
    if not admin_role:
        admin_role = Role(rolename='admin', description='Administrator')
        db.session.add(admin_role)

    # Create test user
    test_user = User.query.filter_by(username='admin').first()
    if not test_user:
        test_user = User(
            username='admin',
            email='admin@localhost',
            passwordhash=generate_password_hash('admin123'),
            isactive=True
        )
        test_user.roles.append(admin_role)
        db.session.add(test_user)
        db.session.commit()
        click.echo(click.style("Test user created: admin / admin123", fg='green'))
    else:
        click.echo(click.style("Test user already exists", fg='yellow'))


@seed_cli.command('admin')
@click.option('--username', required=True, help='Admin login username')
@click.option('--email', required=True, help='Admin email address')
@click.option('--password', default=None,
              help='Admin password. Omit to generate a strong one and print it once.')
@with_appcontext
def seed_admin(username, email, password):
    """Create the first admin user for a new site.

    Password is generated and printed ONCE if not supplied. Store it safely.
    """
    import secrets
    from shopdb.extensions import db
    from shopdb.core.models import User, Role
    from werkzeug.security import generate_password_hash

    if User.query.filter_by(username=username).first():
        click.echo(click.style(f'User "{username}" already exists.', fg='yellow'))
        return

    admin_role = Role.query.filter_by(rolename='admin').first()
    if not admin_role:
        admin_role = Role(rolename='admin', description='Administrator')
        db.session.add(admin_role)

    generated = password is None
    if generated:
        password = secrets.token_urlsafe(12)

    user = User(username=username, email=email,
                passwordhash=generate_password_hash(password), isactive=True)
    user.roles.append(admin_role)
    db.session.add(user)
    db.session.commit()

    click.echo(click.style(f'Admin "{username}" created.', fg='green'))
    if generated:
        click.echo(click.style('=' * 52, fg='cyan'))
        click.echo(click.style(f'  Password: {password}', fg='cyan', bold=True))
        click.echo(click.style('  Store this now - it will not be shown again.', fg='cyan'))
        click.echo(click.style('=' * 52, fg='cyan'))


@click.group('relationships')
def relationships_cli():
    """Asset-relationship maintenance commands."""
    pass


@relationships_cli.command('propagate')
@with_appcontext
def propagate_relationships():
    """Backfill propagated relationship rows across symmetric rails.

    Scans every existing relationship of a type that propagates through a
    symmetric through-type (e.g. controls through Dualpath) and creates the
    missing fanned-out rows. Idempotent. Also serves the legacy-import flow:
    the import creates controls links on primary bays, this fans them out to
    the Dualpath partner bays.
    """
    from shopdb.extensions import db
    from shopdb.core.models.relationship import RelationshipType, AssetRelationship
    from shopdb.core.api.assets import propagate_relationship

    # types that actually propagate through at least one symmetric through-type
    propagating_ids = [
        t.relationshiptypeid for t in RelationshipType.query.all()
        if any(not through.isdirectional for through in t.propagatesthrough)
    ]

    total = 0
    if propagating_ids:
        rels = AssetRelationship.query.filter(
            AssetRelationship.relationshiptypeid.in_(propagating_ids),
            AssetRelationship.isactive == True,
        ).all()
        for rel in rels:
            total += len(propagate_relationship(rel))
        db.session.commit()

    click.echo(click.style(f"Propagated {total} relationship row(s).", fg='green'))


@relationships_cli.command('fix-controls-direction')
@with_appcontext
def fix_controls_direction():
    """Flip reversed legacy controls rows so the PC is the source.

    Legacy import stores controls as device -> PC, which reads as the device
    having authority over the PC. In reality the PC is the controller (it
    sends programs to the device and receives logs), so per ADR-001 the PC
    must be the source. Flips every active controls row whose target is a
    computer and whose source is not. If the flipped row already exists, the
    reversed duplicate is deactivated instead. Idempotent.

    Covers machines, measuring tools, printers and network devices. It used to
    match machines ONLY, so a CMM PC kept showing "<- controls from CMM4"
    alongside its own outgoing link and no amount of running this fixed it.
    """
    from sqlalchemy.orm import aliased
    from shopdb.extensions import db
    from shopdb.core.models import Asset, AssetType
    from shopdb.core.models.relationship import RelationshipType, AssetRelationship

    controls = RelationshipType.query.filter_by(relationshiptype='controls').first()
    if not controls:
        click.echo(click.style("No 'controls' relationship type; nothing to do.", fg='yellow'))
        return

    sourceasset = aliased(Asset)
    targetasset = aliased(Asset)
    sourcetype = aliased(AssetType)
    targettype = aliased(AssetType)

    reversed_rows = (
        AssetRelationship.query
        .join(sourceasset, AssetRelationship.sourceassetid == sourceasset.assetid)
        .join(targetasset, AssetRelationship.targetassetid == targetasset.assetid)
        .join(sourcetype, sourceasset.assettypeid == sourcetype.assettypeid)
        .join(targettype, targetasset.assettypeid == targettype.assettypeid)
        .filter(
            AssetRelationship.relationshiptypeid == controls.relationshiptypeid,
            AssetRelationship.isactive == True,
            # ANY non-computer controlled BY a computer, not just machines. The
            # original filter said assettype == 'machine', which left every
            # measuring_tool -> computer row untouched - a CMM PC showing
            # "<- controls from CMM4" beside its own outgoing link, which is
            # exactly the shape this command exists to clean. Printers and
            # network devices reach shopdb the same way and had the same gap.
            sourcetype.assettype != 'computer',
            targettype.assettype == 'computer',
        )
        .all()
    )

    flipped = 0
    deactivated = 0
    for row in reversed_rows:
        duplicate = AssetRelationship.query.filter_by(
            sourceassetid=row.targetassetid,
            targetassetid=row.sourceassetid,
            relationshiptypeid=controls.relationshiptypeid,
        ).first()
        if duplicate:
            # The correctly-directed row exists - but it may itself be soft
            # deleted, and deletion here IS soft. Retiring this row without
            # looking left the pair with NO live link, while the command
            # reported a successful clean-up. Reactivate the one pointing the
            # right way before retiring the one pointing the wrong way.
            if not duplicate.isactive:
                duplicate.isactive = True
            row.isactive = False  # flipped row already exists, retire this one
            deactivated += 1
        else:
            row.sourceassetid, row.targetassetid = row.targetassetid, row.sourceassetid
            flipped += 1
    db.session.commit()

    click.echo(click.style(
        f"Flipped {flipped} controls row(s) to PC -> machine"
        f" ({deactivated} reversed duplicate(s) deactivated).", fg='green'))


@seed_cli.command('permissions')
@with_appcontext
def seed_permissions():
    """Seed predefined permissions."""
    from shopdb.extensions import db
    from shopdb.core.models import Permission

    created = Permission.seed()
    db.session.commit()
    click.echo(click.style(f"{created} permissions created.", fg='green'))


@seed_cli.command('settings')
@with_appcontext
def seed_settings():
    """Seed default system settings."""
    from shopdb.extensions import db
    from shopdb.core.models import Setting
    from shopdb.core.api.settings import build_default_settings

    defaults = build_default_settings()

    created = 0
    for d in defaults:
        if not Setting.query.filter_by(key=d['key']).first():
            setting = Setting(**d)
            db.session.add(setting)
            created += 1

    db.session.commit()
    click.echo(click.style(f"{created} default settings created.", fg='green'))


# Demo assets carry this assetnumber prefix so a re-run skips what it made and
# an operator can bulk-delete them without touching imported/real rows.
DEMO_PREFIX = 'DEMO-'


@seed_cli.command('demo')
@click.option('--force', is_flag=True,
              help='Add demo rows even if DEMO- assets already exist.')
@with_appcontext
def seed_demo(force):
    """Seed a small, broad sample dataset for a dev/eval site.

    Populates a handful of rows across every asset-based plugin (machines,
    computers, printers, network devices, measuring tools) plus 3D-printed
    parts, with supporting vendors/business-units/locations and a few
    relationships, so every screen has something to show. Run AFTER
    `flask seed reference-data` and after the plugins are installed. Idempotent:
    all rows are keyed on the DEMO- prefix and skipped if already present.

    Not for production. Remove later with:
      flask seed demo-clear
    """
    from shopdb.extensions import db
    from shopdb.core.models import (Asset, AssetType, AssetStatus, Location,
                                    BusinessUnit, Vendor)

    existing = Asset.query.filter(
        Asset.assetnumber.like(f'{DEMO_PREFIX}%')).count()
    if existing and not force:
        click.echo(click.style(
            f"{existing} demo assets already present - nothing to do "
            f"(use --force to add more, or `flask seed demo-clear` to reset).",
            fg='yellow'))
        return

    def status_id(name, fallback=1):
        # resolve status by name, fall back to whatever id 1 is
        s = AssetStatus.query.filter_by(status=name).first()
        return s.statusid if s else fallback

    def get_or_make(model, defaults=None, **lookup):
        # tiny idempotent upsert keyed on lookup fields
        row = model.query.filter_by(**lookup).first()
        if row:
            return row
        row = model(**lookup, **(defaults or {}))
        db.session.add(row)
        db.session.flush()
        return row

    # Supporting reference rows (shared across the asset types below).
    vendors = {v: get_or_make(Vendor, vendor=v) for v in
               ('Haas Automation', 'DMG Mori', 'Dell', 'Zeiss', 'Cisco',
                'Brother')}
    units = {u: get_or_make(BusinessUnit, businessunit=u) for u in
             ('Machining', 'Inspection', 'IT')}
    locations = {loc: get_or_make(Location, locationname=loc) for loc in
                 ('Cell A', 'Cell B', 'QA Lab', 'Server Room', 'Front Office')}

    made = {'assets': 0, 'skipped': 0}

    def make_asset(assettype_name, number, name, subtype_model,
                   status='In Use', location=None, unit=None, vendor=None,
                   serialnumber=None, subtype_kwargs=None):
        # create one Asset + its plugin subtype row, idempotent on assetnumber.
        # returns the Asset, or None when the plugin type is not installed.
        if subtype_model is None:
            return None  # plugin absent on a lean build - skip its demo rows
        atype = AssetType.query.filter_by(assettype=assettype_name).first()
        if not atype:
            return None
        assetnumber = f'{DEMO_PREFIX}{number}'
        if Asset.query.filter_by(assetnumber=assetnumber).first():
            made['skipped'] += 1
            return None
        asset = Asset(
            assetnumber=assetnumber,
            name=name,
            assettypeid=atype.assettypeid,
            statusid=status_id(status),
            serialnumber=serialnumber,
            locationid=locations[location].locationid if location else None,
            businessunitid=units[unit].businessunitid if unit else None,
        )
        db.session.add(asset)
        db.session.flush()
        sub = subtype_model(assetid=asset.assetid, **(subtype_kwargs or {}))
        db.session.add(sub)
        made['assets'] += 1
        return asset

    # Guarded so demo seeding still works on a lean build that omits any of
    # these plugins (ADR-013 Phase 5): a missing model just skips its section.
    def _subtype_model(modulename, classname):
        try:
            module = __import__(f'plugins.{modulename}.models',
                                fromlist=[classname])
            return getattr(module, classname)
        except ImportError:
            return None

    Machine = _subtype_model('machines', 'Machine')
    Computer = _subtype_model('computers', 'Computer')
    Printer = _subtype_model('printers', 'Printer')
    NetworkDevice = _subtype_model('network', 'NetworkDevice')
    MeasuringTool = _subtype_model('measuringtools', 'MeasuringTool')

    machines = [
        ('MILL-01', 'Haas VF-2 Mill', 'In Use', 'Cell A', 'Machining'),
        ('MILL-02', 'Haas VF-4 Mill', 'In Use', 'Cell A', 'Machining'),
        ('LATHE-01', 'DMG Mori NLX Lathe', 'In Use', 'Cell B', 'Machining'),
        ('LATHE-02', 'DMG Mori CLX Lathe', 'In Repair', 'Cell B', 'Machining'),
        ('EDM-01', 'Wire EDM', 'Inventory', 'Cell B', 'Machining'),
        ('GRIND-01', 'Surface Grinder', 'In Use', 'Cell A', 'Machining'),
    ]
    for num, name, st, loc, unit in machines:
        make_asset('machine', num, name, Machine, status=st,
                   location=loc, unit=unit, serialnumber=f'SN-{num}')

    computers = [
        ('PC-01', 'Shopfloor PC - Cell A', 'In Use', 'Cell A'),
        ('PC-02', 'Shopfloor PC - Cell B', 'In Use', 'Cell B'),
        ('PC-03', 'QA Workstation', 'In Use', 'QA Lab'),
        ('PC-04', 'Engineering Laptop', 'In Use', 'Front Office'),
        ('PC-05', 'Spare Desktop', 'Inventory', 'Front Office'),
        ('PC-06', 'Retired Tower', 'Retired', 'Front Office'),
    ]
    for num, name, st, loc in computers:
        make_asset('computer', num, name, Computer, status=st,
                   location=loc, unit='IT', serialnumber=f'SN-{num}')

    printers = [
        ('PRN-01', 'Cell A Label Printer', 'In Use', 'Cell A'),
        ('PRN-02', 'QA Report Printer', 'In Use', 'QA Lab'),
        ('PRN-03', 'Office MFP', 'In Use', 'Front Office'),
        ('PRN-04', 'Spare Printer', 'Inventory', 'Front Office'),
    ]
    for num, name, st, loc in printers:
        make_asset('printer', num, name, Printer, status=st,
                   location=loc, unit='IT')

    network = [
        ('NET-01', 'Cell A Switch', 'In Use', 'Cell A'),
        ('NET-02', 'Cell B Switch', 'In Use', 'Cell B'),
        ('NET-03', 'Core Switch', 'In Use', 'Server Room'),
        ('NET-04', 'Shop Access Point', 'In Use', 'Cell A'),
    ]
    for num, name, st, loc in network:
        make_asset('network_device', num, name, NetworkDevice, status=st,
                   location=loc, unit='IT')

    tools = [
        ('CMM-01', 'Zeiss CMM', 'In Use', 'QA Lab'),
        ('GAGE-01', 'Height Gage', 'In Use', 'QA Lab'),
        ('GAGE-02', 'Bore Gage', 'In Use', 'QA Lab'),
        ('MIC-01', 'Digital Micrometer', 'In Use', 'Cell A'),
        ('CAL-01', 'Digital Caliper', 'Inventory', 'QA Lab'),
    ]
    for num, name, st, loc in tools:
        make_asset('measuring_tool', num, name, MeasuringTool, status=st,
                   location=loc, unit='Inspection')

    # 3D-printed parts are not assets - own table. A couple sit below their
    # low-stock threshold on purpose so the low-stock alert has something to fire.
    printedparts_made = 0
    try:
        from plugins.printedparts.models import PrintedItem
        parts = [
            # itemname, itemcode, gagelabtag, qty, threshold, bin
            ('Fixture Bracket', 'PP0001', 'WJRP10021', 12, 4, 'A1'),
            ('Gage Holder', 'PP0002', 'WJRP10022', 3, 5, 'A2'),
            ('Cable Clip', 'PP0003', None, 40, 10, 'B1'),
            ('Sensor Mount', 'PP0004', 'WJRP10023', 2, 6, 'B2'),
            ('Label Guide', 'PP0005', None, 25, 8, 'C1'),
            ('Knob Cover', 'PP0006', None, 0, 3, 'C2'),
        ]
        for name, code, tag, qty, thr, binloc in parts:
            if PrintedItem.query.filter_by(itemcode=code).first():
                continue
            db.session.add(PrintedItem(
                itemname=name, itemcode=code, gagelabtag=tag,
                quantityonhand=qty, lowstockthreshold=thr, binlocation=binloc,
                itemdescription=f'Sample 3D-printed part: {name}.'))
            printedparts_made += 1
    except ImportError:
        pass  # printedparts plugin not installed - skip

    db.session.flush()

    # A few relationships so the map + relationship cards are not empty.
    rels_made = 0
    try:
        from shopdb.core.models.relationship import (RelationshipType,
                                                     AssetRelationship)

        def asset_by(number):
            return Asset.query.filter_by(
                assetnumber=f'{DEMO_PREFIX}{number}').first()

        def link(source_num, target_num, typename):
            nonlocal rels_made
            rt = RelationshipType.query.filter_by(
                relationshiptype=typename).first()
            s, t = asset_by(source_num), asset_by(target_num)
            if not (rt and s and t):
                return
            exists = AssetRelationship.query.filter_by(
                sourceassetid=s.assetid, targetassetid=t.assetid,
                relationshiptypeid=rt.relationshiptypeid).first()
            if exists:
                return
            db.session.add(AssetRelationship(
                sourceassetid=s.assetid, targetassetid=t.assetid,
                relationshiptypeid=rt.relationshiptypeid))
            rels_made += 1

        link('PC-01', 'MILL-01', 'controls')       # cell PC drives the mill
        link('PC-02', 'LATHE-01', 'controls')
        link('PC-01', 'PRN-01', 'defaultprinter')  # PC to its default printer
        link('MILL-01', 'NET-01', 'connectedto')   # machine on the cell switch
        link('NET-01', 'NET-03', 'connectedto')    # cell switch to core
    except Exception:
        pass  # relationship model surface changed - skip, assets still seeded

    db.session.commit()
    click.echo(click.style(
        f"Demo data seeded: {made['assets']} assets, "
        f"{printedparts_made} printed parts, {rels_made} relationships "
        f"({made['skipped']} already existed).", fg='green'))
    click.echo("Remove later with: flask seed demo-clear")


@seed_cli.command('demo-clear')
@click.option('--yes', is_flag=True, help='Skip the confirmation prompt.')
@with_appcontext
def seed_demo_clear(yes):
    """Delete everything `flask seed demo` created (DEMO- assets + sample parts).

    Only touches rows the demo seeder made: assets with the DEMO- prefix (their
    plugin subtype rows cascade) and the PP000x sample printed parts. Leaves
    reference data, settings, users, and any real/imported rows alone.
    """
    from shopdb.extensions import db
    from shopdb.core.models import Asset

    demo_ids = [a.assetid for a in Asset.query.filter(
        Asset.assetnumber.like(f'{DEMO_PREFIX}%')).all()]
    try:
        from plugins.printedparts.models import PrintedItem
        parts_count = PrintedItem.query.filter(
            PrintedItem.itemcode.like('PP000%')).count()
    except ImportError:
        parts_count = 0

    if not demo_ids and not parts_count:
        click.echo(click.style("No demo data found.", fg='yellow'))
        return
    if not yes:
        click.confirm(
            f"Delete {len(demo_ids)} demo assets and "
            f"{parts_count} sample parts?", abort=True)

    if demo_ids:
        # Drop the demo relationships first - assetrelationships has no cascade
        # to assets, so a leftover edge would block the asset delete.
        from shopdb.core.models.relationship import AssetRelationship
        AssetRelationship.query.filter(
            db.or_(AssetRelationship.sourceassetid.in_(demo_ids),
                   AssetRelationship.targetassetid.in_(demo_ids))
        ).delete(synchronize_session=False)
        # Bulk hard-delete via a single DELETE statement so the DB-level
        # ON DELETE CASCADE removes each plugin subtype row. Per-object
        # ORM delete would instead try to NULL the child assetid (NOT NULL)
        # and fail.
        Asset.query.filter(Asset.assetid.in_(demo_ids)).delete(
            synchronize_session=False)

    parts_deleted = 0
    if parts_count:
        parts_deleted = PrintedItem.query.filter(
            PrintedItem.itemcode.like('PP000%')).delete(
            synchronize_session=False)

    db.session.commit()
    click.echo(click.style(
        f"Removed {len(demo_ids)} demo assets and "
        f"{parts_deleted} sample parts.", fg='green'))


@click.group('csv')
def csv_cli():
    """Load a site's starting data from CSV files."""
    pass


@csv_cli.command('templates')
@click.option('--out', 'outdir', default='csv-templates',
              help='Directory to write the templates into.')
@with_appcontext
def csv_templates(outdir):
    """Write a CSV template per importable table, generated from the schema.

    Generated rather than kept by hand: a maintained template set drifts on the
    next migration and does so silently, since the file still looks correct.
    """
    import os
    from shopdb.core.services.csvimport import IMPORTABLE, generate_template

    if not os.path.isdir(outdir):
        os.makedirs(outdir)
    for tablename in IMPORTABLE:
        path = os.path.join(outdir, tablename + '.csv')
        with open(path, 'w', encoding='utf-8') as handle:
            handle.write(generate_template(tablename))
        click.echo('  %s' % path)

    readme = os.path.join(outdir, 'README.txt')
    with open(readme, 'w', encoding='utf-8') as handle:
        handle.write(
            'ShopDB-Flask import templates\n'
            '=============================\n\n'
            'Generated from the live database schema. Every column here exists;\n'
            'every required column is marked.\n\n'
            'Fill in the ones you need - you do not need all of them.\n\n'
            'Foreign keys take a NAME or a numeric id. Write the name:\n'
            '    locationid  ->  Building 1 Bay 3\n'
            '    vendorid    ->  Haas Automation\n'
            'The importer resolves it, and tells you which row and column to fix\n'
            'if the name is not found.\n\n'
            'Import the whole folder at once and order is handled for you:\n\n'
            '    flask csv import --dir .            (checks only, changes nothing)\n'
            '    flask csv import --dir . --commit   (applies)\n\n'
            'Nothing is written unless every row passes, so a mistake on line 400\n'
            'does not leave 399 rows half-imported.\n\n'
            'User accounts are deliberately not importable here: passwords do not\n'
            'belong in a spreadsheet.\n')
    click.echo('  %s' % readme)
    click.echo('')
    click.echo(click.style('%d templates written to %s' % (len(IMPORTABLE), outdir),
                           fg='green', bold=True))


@csv_cli.command('import')
@click.option('--file', 'path', default=None, help='One CSV file.')
@click.option('--dir', 'directory', default=None,
              help='A folder of CSVs, imported in dependency order.')
@click.option('--table', 'tablename', default=None,
              help='Target table. Defaults to the file name.')
@click.option('--commit', is_flag=True, default=False,
              help='Apply the changes. Without this, nothing is written.')
@with_appcontext
def csv_import(path, directory, tablename, commit):
    """Validate CSVs and, with --commit, load them.

    Dry run by default. The report is the same either way, so what you review is
    what you get.
    """
    import os
    from shopdb.extensions import db
    from sqlalchemy.exc import SQLAlchemyError
    from shopdb.core.services.csvimport import (
        ImportError_, Resolver, dependency_order, import_csv, table_from_filename)

    if not path and not directory:
        raise click.UsageError('give --file or --dir')

    jobs = []
    if path:
        jobs.append((tablename or table_from_filename(os.path.basename(path)), path))
    else:
        found = {}
        for name in os.listdir(directory):
            if not name.lower().endswith('.csv'):
                continue
            found[table_from_filename(name)] = os.path.join(directory, name)
        ordered = dependency_order(list(found))
        unknown = sorted(set(found) - set(ordered))
        for name in ordered:
            jobs.append((name, found[name]))
        if unknown:
            click.echo(click.style(
                'skipping (not importable): %s' % ', '.join(unknown), fg='yellow'))

    if not jobs:
        click.echo('nothing to do - no CSV files found')
        return

    click.echo(click.style(
        'Checking %d file(s)%s' % (len(jobs), '' if commit else ' - DRY RUN, nothing will be written'),
        bold=True))
    click.echo('')

    resolver = Resolver()
    results = []
    failed = False
    for name, filepath in jobs:
        with open(filepath, 'r', encoding='utf-8-sig') as handle:
            text = handle.read()
        try:
            # Every file is applied inside ONE transaction, so a failure part way
            # through a folder rolls the whole run back rather than leaving the
            # site half-populated.
            result = import_csv(name, text, resolver=resolver, commit=commit)
        except ImportError_ as exc:
            click.echo(click.style('  %-18s %s' % (name, exc), fg='red'))
            failed = True
            continue
        except SQLAlchemyError as exc:
            # Anything the database itself refuses. The operator gets the cause
            # in one line rather than a traceback they cannot act on.
            db.session.rollback()
            click.echo(click.style('  %-18s database error: %s'
                                   % (name, str(exc).split(chr(10))[0]), fg='red'))
            failed = True
            continue
        results.append(result)
        colour = 'green' if result.ok else 'red'
        click.echo(click.style('  ' + result.summary(), fg=colour))
        for problem in result.problems[:20]:
            click.echo(click.style('      %s' % problem, fg='red'))
        if len(result.problems) > 20:
            click.echo(click.style('      ... and %d more' % (len(result.problems) - 20), fg='red'))
        if not result.ok:
            failed = True

    click.echo('')
    if failed:
        db.session.rollback()
        click.echo(click.style('Nothing was imported. Fix the problems above and run again.',
                               fg='red', bold=True))
        raise SystemExit(1)

    total_new = sum(r.created for r in results)
    total_upd = sum(r.updated for r in results)
    if commit:
        db.session.commit()
        click.echo(click.style('Imported: %d new, %d updated.' % (total_new, total_upd),
                               fg='green', bold=True))
    else:
        db.session.rollback()
        click.echo(click.style(
            'Looks good: %d would be created, %d updated.' % (total_new, total_upd),
            fg='green', bold=True))
        click.echo('Run again with --commit to apply.')


@relationships_cli.command('check-shared-machines')
@with_appcontext
def check_shared_machines():
    """Find machine numbers that more than one PC reports against.

    Two very different situations look identical from the outside, and both
    were found the hard way rather than by asking:

    LEGITIMATE - several devices genuinely share one number. Part markers do:
    0613, 0615 and WJPRT each carry more than one, and their configurations
    differ by COM port. Modelled correctly, each device is its own asset filed
    `partof` the operation, so the operation has CHILD ASSETS.

    A FAULT - two PCs carrying the same machine number, usually a mistake at
    imaging. Nothing is filed under the operation, the PCs contest one link,
    and whichever reported last appears to own the machine.

    The difference is whether child assets exist, which is exactly what this
    reports. Read-only.
    """
    from shopdb.extensions import db
    from shopdb.core.models import Asset, AssetRelationship, RelationshipType
    from sqlalchemy.orm import aliased

    controls = RelationshipType.query.filter_by(relationshiptype='controls').first()
    partof = RelationshipType.query.filter_by(relationshiptype='partof').first()
    if not controls:
        click.echo(click.style("No 'controls' relationship type; "
                               'run flask seed reference-data.', fg='yellow'))
        return

    pcasset = aliased(Asset)
    machineasset = aliased(Asset)

    # Every active collector-made PC -> machine link, grouped by machine.
    rows = (db.session.query(machineasset.assetid, machineasset.assetnumber,
                             pcasset.assetnumber)
            .select_from(AssetRelationship)
            .join(pcasset, AssetRelationship.sourceassetid == pcasset.assetid)
            .join(machineasset, AssetRelationship.targetassetid == machineasset.assetid)
            .filter(AssetRelationship.relationshiptypeid == controls.relationshiptypeid,
                    AssetRelationship.label == 'collector:machine',
                    AssetRelationship.isactive.is_(True))
            .all())

    bymachine = {}
    for assetid, machinenumber, pcnumber in rows:
        bymachine.setdefault((assetid, machinenumber), []).append(pcnumber)

    shared = {k: v for k, v in bymachine.items() if len(v) > 1}
    if not shared:
        click.echo(click.style('No machine number is claimed by more than one PC.',
                               fg='green'))
        return

    faults = 0
    for (assetid, machinenumber), pcs in sorted(shared.items(), key=lambda kv: kv[0][1] or ''):
        children = 0
        if partof:
            children = (AssetRelationship.query
                        .filter_by(targetassetid=assetid,
                                   relationshiptypeid=partof.relationshiptypeid,
                                   isactive=True)
                        .count())
        if children:
            click.echo('  {:<10} {} PCs, {} child asset(s) - modelled'.format(
                machinenumber, len(pcs), children))
        else:
            faults += 1
            click.echo(click.style(
                '  {:<10} {} PCs, NO child assets - {}'.format(
                    machinenumber, len(pcs), ', '.join(sorted(pcs))), fg='yellow'))

    click.echo()
    if faults:
        click.echo(click.style(
            '{} machine number(s) claimed by several PCs with nothing filed '
            'under them.'.format(faults), fg='yellow', bold=True))
        click.echo('Either the PCs are mis-numbered - fix that on the PC - or the '
                   'device type needs an entry in SUBORDINATE_DEVICE_MAP so each '
                   'device becomes its own asset.')
    else:
        click.echo(click.style('Every shared number has child assets.', fg='green'))


@relationships_cli.command('audit')
@with_appcontext
def audit_relationships():
    """Report relationship rows that cannot all be true. Read-only.

    Three faults share one symptom - an asset page listing the same peer more
    than once - and they need different fixes, so this names which is which.

    1. RECIPROCAL PAIRS. Both `A controls B` and `B controls A` exist. Only one
       can be true: a PC drives a machine, never the reverse. The create path
       only ever checked (source, target, type), so the inverse inserted
       cleanly, and the Add Relationship dialog offers an `incoming` direction
       that writes exactly that. The legacy import stores controls the wrong way
       round as well. `flask relationships fix-controls-direction` cleans the
       machine->computer ones; anything else is listed here for a decision.

    2. SELF-LINKS. An asset pointing at ITSELF, which renders as a duplicate on
       its own page and is never meaningful.

    3. DUPLICATE DEVICES. One PC controlling several assets of the same type -
       three measuring tools for one physical CMM, say. The collector keys its
       idempotency on its own label, so a device somebody created by hand, or
       the legacy import created, is invisible to it and it mints another one on
       every fresh PC.

    The `label` on each row usually names the writer outright, so it is printed:
    `collector:*` means this code made it, anything else means a person or the
    import did. Nothing is modified - decide from the output which side of a
    pair is authoritative before deleting anything.
    """
    from shopdb.extensions import db
    from shopdb.core.models import Asset, AssetType
    from shopdb.core.models.relationship import AssetRelationship, RelationshipType
    from sqlalchemy.orm import aliased
    from collections import defaultdict

    faults = 0

    def assetlabel(asset):
        if not asset:
            return '?'
        return f'{asset.assetnumber or asset.name or asset.assetid}'

    # ---- 1. reciprocal pairs (directional types only) ----------------------
    # Symmetric types store both directions ON PURPOSE, so they are excluded -
    # flagging them would bury the real faults in noise.
    directional = {t.relationshiptypeid: t.relationshiptype
                   for t in RelationshipType.query.all() if t.isdirectional}
    rows = (AssetRelationship.query
            .filter(AssetRelationship.isactive.is_(True),
                    AssetRelationship.relationshiptypeid.in_(directional or [0]))
            .all()) if directional else []

    bykey = {}
    for rel in rows:
        bykey[(rel.sourceassetid, rel.targetassetid, rel.relationshiptypeid)] = rel

    seen = set()
    reciprocal = []
    for (source, target, typeid), rel in bykey.items():
        # A self-link is its own inverse. It is a fault, but a DIFFERENT one,
        # reported below - counting it here would double-report it and print
        # the same row twice as though it were a pair.
        if source == target:
            continue
        inverse = bykey.get((target, source, typeid))
        if inverse and (target, source, typeid) not in seen:
            seen.add((source, target, typeid))
            reciprocal.append((rel, inverse))

    click.echo(click.style('\n== Reciprocal pairs (both directions stored) ==',
                           bold=True))
    if reciprocal:
        faults += len(reciprocal)
        for rel, inverse in reciprocal:
            typename = directional.get(rel.relationshiptypeid, '?')
            a = db.session.get(Asset, rel.sourceassetid)
            b = db.session.get(Asset, rel.targetassetid)
            click.echo(f'  {assetlabel(a)} -{typename}-> {assetlabel(b)}   '
                       f'[id {rel.relationshipid}, label={rel.label or "-"}]')
            click.echo(f'  {assetlabel(b)} -{typename}-> {assetlabel(a)}   '
                       f'[id {inverse.relationshipid}, label={inverse.label or "-"}]')
            click.echo('')
        click.echo(click.style(
            f'  {len(reciprocal)} pair(s). Only one direction can be true.',
            fg='yellow'))
    else:
        click.echo(click.style('  none', fg='green'))

    # ---- 2. self-links ------------------------------------------------------
    selflinks = (AssetRelationship.query
                 .filter(AssetRelationship.isactive.is_(True),
                         AssetRelationship.sourceassetid
                         == AssetRelationship.targetassetid)
                 .all())
    click.echo(click.style('\n== Self-links (asset pointing at itself) ==',
                           bold=True))
    if selflinks:
        faults += len(selflinks)
        for rel in selflinks:
            asset = db.session.get(Asset, rel.sourceassetid)
            typename = (rel.relationshiptype.relationshiptype
                        if rel.relationshiptype else '?')
            click.echo(f'  {assetlabel(asset)} -{typename}-> itself   '
                       f'[id {rel.relationshipid}, label={rel.label or "-"}]')
        click.echo(click.style(f'  {len(selflinks)} row(s). Never meaningful.',
                               fg='yellow'))
    else:
        click.echo(click.style('  none', fg='green'))

    # ---- 3. duplicate devices per PC ---------------------------------------
    controls = RelationshipType.query.filter_by(relationshiptype='controls').first()
    click.echo(click.style(
        '\n== PCs controlling several assets of the SAME type ==', bold=True))
    if not controls:
        click.echo(click.style('  no controls type; run flask seed reference-data',
                               fg='yellow'))
    else:
        sourceasset = aliased(Asset)
        targetasset = aliased(Asset)
        targettype = aliased(AssetType)
        pairs = (db.session.query(AssetRelationship, sourceasset,
                                  targetasset, targettype.assettype)
                 .select_from(AssetRelationship)
                 .join(sourceasset,
                       AssetRelationship.sourceassetid == sourceasset.assetid)
                 .join(targetasset,
                       AssetRelationship.targetassetid == targetasset.assetid)
                 .join(targettype,
                       targetasset.assettypeid == targettype.assettypeid)
                 .filter(AssetRelationship.relationshiptypeid
                         == controls.relationshiptypeid,
                         AssetRelationship.isactive.is_(True))
                 .all())

        # Devices that are SYMMETRIC partners of each other (Dualpath) are one
        # physical machine with one controller, and `controls` is propagated to
        # both bays on purpose - see propagate_relationship. Reporting those as
        # duplicates buries the real faults: on this dev database they are the
        # overwhelming majority, consecutive bay numbers pair by pair.
        siblings = set()
        symmetric = [t.relationshiptypeid for t in RelationshipType.query.all()
                     if not t.isdirectional]
        if symmetric:
            for rel in (AssetRelationship.query
                        .filter(AssetRelationship.isactive.is_(True),
                                AssetRelationship.relationshiptypeid.in_(symmetric))
                        .all()):
                siblings.add((rel.sourceassetid, rel.targetassetid))
                siblings.add((rel.targetassetid, rel.sourceassetid))

        def all_siblings(deviceids):
            return all((a, b) in siblings
                       for index, a in enumerate(deviceids)
                       for b in deviceids[index + 1:])

        grouped = defaultdict(list)
        for rel, pcasset, device, devicetype in pairs:
            grouped[(pcasset.assetid, devicetype)].append((rel, pcasset, device))

        dupes = {key: value for key, value in grouped.items()
                 if len(value) > 1
                 and not all_siblings([item[2].assetid for item in value])}
        if dupes:
            faults += len(dupes)
            for (pcassetid, devicetype), items in sorted(
                    dupes.items(), key=lambda kv: -len(kv[1])):
                pcasset = items[0][1]
                click.echo(f'  {assetlabel(pcasset)} controls '
                           f'{len(items)} x {devicetype}:')
                for rel, _, device in items:
                    click.echo(f'      {assetlabel(device)}'
                               f'  (name={device.name or "-"})'
                               f'  [id {rel.relationshipid}, '
                               f'label={rel.label or "-"}]')
            click.echo(click.style(
                f'  {len(dupes)} PC/type group(s). A label of "-" or a '
                'non-collector value means the collector cannot see that row '
                'and will keep minting its own.', fg='yellow'))
        else:
            click.echo(click.style('  none', fg='green'))

    click.echo('')
    if faults:
        click.echo(click.style(f'{faults} fault group(s) found. Nothing was '
                               'changed.', fg='yellow'))
        click.echo('Do NOT bulk-delete one side of a reciprocal pair before '
                   'knowing which side is authoritative.')
    else:
        click.echo(click.style('No relationship faults found.', fg='green'))
