"""CRUD API for Configuration and Business Policies.

Registered on computers_bp under /api/computers/policies/... Kept in its own
module so the whole policy surface can be removed by not importing it - part of
the exit gate. Every route first checks the computers_configpolicies_enabled
switch and returns 404 while it is off, so enabling/disabling the feature never
half-exposes it.

Write-time validation lives here (not in the model): scope ASTs go through
validate_scope, and action names are checked against the endpoints command
allowlist, so a bad tree or an unknown action never reaches the database.
"""

from flask import request

from shopdb.api import (db, AuditLog, success_response, error_response,
                        ErrorCodes, require_permission, caller_holds)

from .routes import computers_bp
from ..models import (ConfigurationPolicy, ConfigurationPolicyAction,
                      BusinessPolicy, BusinessPolicyItem, POLICY_SOURCE_LOCAL,
                      ACTION_MODE_DESIRED, ACTION_MODE_GATE)
from ..policyflag import policy_flag_enabled
from ..services.policyscope import validate_scope, ScopeError

_MODES = {ACTION_MODE_DESIRED, ACTION_MODE_GATE}


def _elevated_denial(actionnames):
    """Refuse unless the caller may author every elevated action in actionnames.

    A policy is a deferred instruction to run something. Gating only the enqueue
    route left authoring wide open: computers.edit alone could author a policy
    carrying run_script and let the agent execute it, which is the whole point of
    splitting the big four undone. The permission to CAUSE an action must be the
    same permission required to RUN it.

    caller_holds, not current_user.haspermission: a scoped personal token is a
    narrower caller than its owner, and asking the owner is the exact bypass
    require_permission exists to prevent.
    """
    from plugins.endpoints.commands import elevated_permission_for

    missing = []
    for name in sorted(set(actionnames)):
        elevated = elevated_permission_for(name)
        if elevated and not caller_holds(elevated) and elevated not in missing:
            missing.append(elevated)
    if not missing:
        return None
    return error_response(
        ErrorCodes.FORBIDDEN,
        'This policy carries actions you may not author. Missing: '
        + ', '.join(missing),
        http_code=403)


def _requested_actionnames(actions):
    return [(row.get('action') or '').strip() for row in actions or []]


def _policy_actionnames(policy):
    return [a.action for a in policy.actions]


def _composed_actionnames(configpolicyids):
    """Every action reachable through a set of configuration policies.

    Composition is an authoring act: adding a configuration policy to a business
    policy causes its actions to run on everything the business policy targets,
    without the composer ever naming those actions.
    """
    names = []
    for cpid in configpolicyids:
        policy = db.session.get(ConfigurationPolicy, cpid)
        if policy:
            names.extend(_policy_actionnames(policy))
    return names


def _changes_effect(data, policy=None):
    """Whether this payload changes WHAT a policy does, rather than how it reads.

    Scope widening, reactivation, priority and composition all change the effect
    of an already-authored action without touching the action list, so gating the
    action payload alone would leave every one of them open. Renaming a policy or
    editing its description changes nothing that runs, so it stays ungated.
    """
    for field in ('actions', 'items', 'scopejson', 'priority'):
        if field in data:
            return True
    if 'isactive' in data:
        # Only reactivation matters. Deactivating a policy cannot widen anything,
        # and refusing it would strand a live policy nobody present can switch off.
        was = getattr(policy, 'isactive', False) if policy is not None else False
        return bool(data['isactive']) and not was
    return False


def _feature_gate():
    """Return a 404 response when the policy feature is off, else None."""
    if not policy_flag_enabled():
        return error_response(ErrorCodes.NOT_FOUND,
                              'Policy feature is not enabled', http_code=404)
    return None


def _known_actions():
    """The code-level allowlist of action names a policy may reference."""
    from plugins.endpoints.commands import COMMAND_ALLOWLIST
    return set(COMMAND_ALLOWLIST.keys())


def _is_valid_action(name):
    """True when an action name is either an allowlisted command or a monitor
    attachment (monitor:<id>) pointing at an existing monitor definition.

    Monitor actions are intentionally kept out of the command allowlist so they
    are never enqueued as commands; they are only valid as policy attachments.
    """
    if name in _known_actions():
        return True
    from plugins.endpoints.commands import monitor_id_from_action
    from plugins.endpoints.models import EndpointMonitor
    monitorid = monitor_id_from_action(name)
    if monitorid is None:
        return False
    return db.session.get(EndpointMonitor, monitorid) is not None


def _configpolicy_dict(policy):
    data = policy.to_dict()
    data['actions'] = [a.to_dict() for a in policy.actions]
    return data


def _businesspolicy_dict(policy):
    data = policy.to_dict()
    data['items'] = [{
        'businesspolicyitemid': it.businesspolicyitemid,
        'configurationpolicyid': it.configurationpolicyid,
        'sortorder': it.sortorder,
        'name': it.configurationpolicy.name if it.configurationpolicy else None,
    } for it in policy.items]
    return data


# =============================================================================
# Configuration Policies
# =============================================================================

@computers_bp.route('/policies/configuration', methods=['GET'])
@require_permission('computers.view')
def list_configuration_policies():
    gate = _feature_gate()
    if gate:
        return gate
    policies = ConfigurationPolicy.query.order_by(ConfigurationPolicy.name).all()
    return success_response([_configpolicy_dict(p) for p in policies])


@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['GET'])
@require_permission('computers.view')
def get_configuration_policy(policy_id: int):
    gate = _feature_gate()
    if gate:
        return gate
    policy = db.session.get(ConfigurationPolicy, policy_id)
    if not policy:
        return error_response(ErrorCodes.NOT_FOUND,
                              'Configuration policy not found', http_code=404)
    return success_response(_configpolicy_dict(policy))


def _apply_actions(policy, actions):
    """Replace a policy's actions from request data, validating each.

    Returns an error_response on failure, else None.
    """
    policy.actions.clear()
    # Flush the deletes before re-appending. The (configurationpolicyid, action)
    # unique constraint collides if SQLAlchemy orders a re-added action's INSERT
    # before the old row's DELETE in the same flush, which surfaces as a generic
    # "value already in use" IntegrityError on an otherwise valid edit.
    db.session.flush()
    for row in actions or []:
        name = (row.get('action') or '').strip()
        if not _is_valid_action(name):
            return error_response(ErrorCodes.VALIDATION_ERROR,
                                  f'Unknown action: {name!r}')
        mode = (row.get('mode') or ACTION_MODE_GATE).strip()
        if mode not in _MODES:
            return error_response(ErrorCodes.VALIDATION_ERROR,
                                  f'Unknown action mode: {mode!r}')
        policy.actions.append(ConfigurationPolicyAction(
            action=name,
            mode=mode,
            desiredstate=row.get('desiredstate'),
            params=row.get('params'),
            intervalminutes=row.get('intervalminutes'),
            sortorder=row.get('sortorder', 0) or 0,
        ))
    return None


@computers_bp.route('/policies/configuration', methods=['POST'])
@require_permission('computers.create')
def create_configuration_policy():
    gate = _feature_gate()
    if gate:
        return gate
    data = request.get_json() or {}
    name = (data.get('name') or '').strip()
    if not name:
        return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
    if ConfigurationPolicy.query.filter_by(name=name).first():
        return error_response(ErrorCodes.CONFLICT,
                              f"Configuration policy '{name}' already exists",
                              http_code=409)

    scope = data.get('scopejson')
    if scope is not None:
        try:
            validate_scope(scope)
        except ScopeError as exc:
            return error_response(ErrorCodes.VALIDATION_ERROR,
                                  f'Invalid scope: {exc}')

    denial = _elevated_denial(_requested_actionnames(data.get('actions')))
    if denial:
        return denial

    policy = ConfigurationPolicy(
        name=name,
        description=data.get('description'),
        scopejson=scope,
        source=POLICY_SOURCE_LOCAL,
    )
    err = _apply_actions(policy, data.get('actions'))
    if err:
        return err

    db.session.add(policy)
    AuditLog.log('created', 'ConfigurationPolicy', entityname=name)
    db.session.commit()
    return success_response(_configpolicy_dict(policy),
                            message='Configuration policy created',
                            http_code=201)


@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['PUT'])
@require_permission('computers.edit')
def update_configuration_policy(policy_id: int):
    gate = _feature_gate()
    if gate:
        return gate
    policy = db.session.get(ConfigurationPolicy, policy_id)
    if not policy:
        return error_response(ErrorCodes.NOT_FOUND,
                              'Configuration policy not found', http_code=404)
    if policy.source != POLICY_SOURCE_LOCAL:
        return error_response(ErrorCodes.CONFLICT,
                              'Policy is managed externally and is read-only',
                              http_code=409)
    data = request.get_json() or {}

    # Both sides. The incoming actions are what the caller is asking to cause;
    # the existing ones are what a scope widening or reactivation would newly
    # unleash on machines that were never in range before.
    if _changes_effect(data, policy):
        names = list(_policy_actionnames(policy))
        if 'actions' in data:
            names.extend(_requested_actionnames(data['actions']))
        denial = _elevated_denial(names)
        if denial:
            return denial

    if 'name' in data:
        newname = (data['name'] or '').strip()
        if newname and newname != policy.name:
            if ConfigurationPolicy.query.filter_by(name=newname).first():
                return error_response(ErrorCodes.CONFLICT,
                                      f"Configuration policy '{newname}' already exists",
                                      http_code=409)
            policy.name = newname
    if 'description' in data:
        policy.description = data['description']
    if 'isactive' in data:
        policy.isactive = data['isactive']
    if 'scopejson' in data:
        scope = data['scopejson']
        if scope is not None:
            try:
                validate_scope(scope)
            except ScopeError as exc:
                return error_response(ErrorCodes.VALIDATION_ERROR,
                                      f'Invalid scope: {exc}')
        policy.scopejson = scope
    if 'actions' in data:
        err = _apply_actions(policy, data['actions'])
        if err:
            return err

    AuditLog.log('updated', 'ConfigurationPolicy', entityname=policy.name)
    db.session.commit()
    return success_response(_configpolicy_dict(policy),
                            message='Configuration policy updated')


@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['DELETE'])
@require_permission('computers.delete')
def delete_configuration_policy(policy_id: int):
    gate = _feature_gate()
    if gate:
        return gate
    policy = db.session.get(ConfigurationPolicy, policy_id)
    if not policy:
        return error_response(ErrorCodes.NOT_FOUND,
                              'Configuration policy not found', http_code=404)
    if policy.source != POLICY_SOURCE_LOCAL:
        return error_response(ErrorCodes.CONFLICT,
                              'Policy is managed externally and is read-only',
                              http_code=409)
    inuse = BusinessPolicyItem.query.filter_by(
        configurationpolicyid=policy_id).count()
    if inuse:
        return error_response(
            ErrorCodes.CONFLICT,
            f'Cannot delete: used by {inuse} business policy item(s)',
            http_code=409)
    # Deleting a gate policy REMOVES a restriction, so it changes what endpoints
    # will run just as surely as authoring one does.
    denial = _elevated_denial(_policy_actionnames(policy))
    if denial:
        return denial
    db.session.delete(policy)
    AuditLog.log('deleted', 'ConfigurationPolicy', entityname=policy.name)
    db.session.commit()
    return success_response(None, message='Configuration policy deleted')


# =============================================================================
# Business Policies
# =============================================================================

@computers_bp.route('/policies/business', methods=['GET'])
@require_permission('computers.view')
def list_business_policies():
    gate = _feature_gate()
    if gate:
        return gate
    policies = (BusinessPolicy.query
                .order_by(BusinessPolicy.priority, BusinessPolicy.businesspolicyid)
                .all())
    return success_response([_businesspolicy_dict(p) for p in policies])


@computers_bp.route('/policies/business/<int:policy_id>', methods=['GET'])
@require_permission('computers.view')
def get_business_policy(policy_id: int):
    gate = _feature_gate()
    if gate:
        return gate
    policy = db.session.get(BusinessPolicy, policy_id)
    if not policy:
        return error_response(ErrorCodes.NOT_FOUND,
                              'Business policy not found', http_code=404)
    return success_response(_businesspolicy_dict(policy))


def _apply_items(policy, items):
    """Replace a business policy's configuration-policy items, validating each."""
    policy.items.clear()
    # Flush the deletes before re-appending so the (businesspolicyid,
    # configurationpolicyid) unique constraint does not collide with a re-added
    # item whose INSERT would otherwise race ahead of the old row's DELETE.
    db.session.flush()
    seen = set()
    for order, row in enumerate(items or []):
        cpid = row.get('configurationpolicyid')
        if cpid is None:
            return error_response(ErrorCodes.VALIDATION_ERROR,
                                  'item requires configurationpolicyid')
        if cpid in seen:
            return error_response(ErrorCodes.VALIDATION_ERROR,
                                  f'duplicate configuration policy {cpid}')
        if not db.session.get(ConfigurationPolicy, cpid):
            return error_response(ErrorCodes.VALIDATION_ERROR,
                                  f'unknown configuration policy {cpid}')
        seen.add(cpid)
        policy.items.append(BusinessPolicyItem(
            configurationpolicyid=cpid,
            sortorder=row.get('sortorder', order),
        ))
    return None


@computers_bp.route('/policies/business', methods=['POST'])
@require_permission('computers.create')
def create_business_policy():
    gate = _feature_gate()
    if gate:
        return gate
    data = request.get_json() or {}
    name = (data.get('name') or '').strip()
    if not name:
        return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
    if BusinessPolicy.query.filter_by(name=name).first():
        return error_response(ErrorCodes.CONFLICT,
                              f"Business policy '{name}' already exists",
                              http_code=409)
    policy = BusinessPolicy(
        name=name,
        description=data.get('description'),
        priority=data.get('priority', 100),
        source=POLICY_SOURCE_LOCAL,
    )
    requested = [row.get('configurationpolicyid')
                 for row in data.get('items') or []]
    denial = _elevated_denial(_composed_actionnames(
        [cpid for cpid in requested if cpid is not None]))
    if denial:
        return denial
    err = _apply_items(policy, data.get('items'))
    if err:
        return err
    db.session.add(policy)
    AuditLog.log('created', 'BusinessPolicy', entityname=name)
    db.session.commit()
    return success_response(_businesspolicy_dict(policy),
                            message='Business policy created', http_code=201)


@computers_bp.route('/policies/business/<int:policy_id>', methods=['PUT'])
@require_permission('computers.edit')
def update_business_policy(policy_id: int):
    gate = _feature_gate()
    if gate:
        return gate
    policy = db.session.get(BusinessPolicy, policy_id)
    if not policy:
        return error_response(ErrorCodes.NOT_FOUND,
                              'Business policy not found', http_code=404)
    if policy.source != POLICY_SOURCE_LOCAL:
        return error_response(ErrorCodes.CONFLICT,
                              'Policy is managed externally and is read-only',
                              http_code=409)
    data = request.get_json() or {}

    # Composition is the quiet escalation: attaching a configuration policy runs
    # its actions everywhere this business policy reaches, without the composer
    # naming a single one of them.
    if _changes_effect(data, policy):
        cpids = [it.configurationpolicyid for it in policy.items]
        for row in data.get('items') or []:
            cpid = row.get('configurationpolicyid')
            if cpid is not None:
                cpids.append(cpid)
        denial = _elevated_denial(_composed_actionnames(cpids))
        if denial:
            return denial

    if 'name' in data:
        newname = (data['name'] or '').strip()
        if newname and newname != policy.name:
            if BusinessPolicy.query.filter_by(name=newname).first():
                return error_response(ErrorCodes.CONFLICT,
                                      f"Business policy '{newname}' already exists",
                                      http_code=409)
            policy.name = newname
    if 'description' in data:
        policy.description = data['description']
    if 'priority' in data:
        policy.priority = data['priority']
    if 'isactive' in data:
        policy.isactive = data['isactive']
    if 'items' in data:
        err = _apply_items(policy, data['items'])
        if err:
            return err
    AuditLog.log('updated', 'BusinessPolicy', entityname=policy.name)
    db.session.commit()
    return success_response(_businesspolicy_dict(policy),
                            message='Business policy updated')


@computers_bp.route('/policies/business/<int:policy_id>', methods=['DELETE'])
@require_permission('computers.delete')
def delete_business_policy(policy_id: int):
    gate = _feature_gate()
    if gate:
        return gate
    policy = db.session.get(BusinessPolicy, policy_id)
    if not policy:
        return error_response(ErrorCodes.NOT_FOUND,
                              'Business policy not found', http_code=404)
    if policy.source != POLICY_SOURCE_LOCAL:
        return error_response(ErrorCodes.CONFLICT,
                              'Policy is managed externally and is read-only',
                              http_code=409)
    denial = _elevated_denial(_composed_actionnames(
        [it.configurationpolicyid for it in policy.items]))
    if denial:
        return denial
    db.session.delete(policy)
    AuditLog.log('deleted', 'BusinessPolicy', entityname=policy.name)
    db.session.commit()
    return success_response(None, message='Business policy deleted')


# =============================================================================
# Action catalog (for the UI) and effective-policy preview
# =============================================================================

@computers_bp.route('/policies/actions', methods=['GET'])
@require_permission('computers.view')
def list_policy_actions():
    """The allowlisted action names + labels a policy may reference.

    Returns command actions tagged kind='command'. Monitor attachments are not
    listed here: the UI builds that branch from the endpoints monitor catalog
    (endpointsApi.monitors) so newly created monitors appear without a reload.

    Actions the caller may not author are marked rather than hidden. Hiding them
    would make the editor look like the capability does not exist; marking them
    says it exists and is not yours, which is the difference between a confusing
    UI and an honest one. The authoring gate is enforced server-side regardless.
    """
    gate = _feature_gate()
    if gate:
        return gate
    from plugins.endpoints.commands import (COMMAND_ALLOWLIST,
                                            elevated_permission_for)
    catalog = []
    for name, meta in COMMAND_ALLOWLIST.items():
        elevated = elevated_permission_for(name)
        catalog.append({
            'action': name,
            'label': meta.get('label'),
            'description': meta.get('description'),
            'kind': 'command',
            'requiredpermission': elevated,
            'mayauthor': not elevated or caller_holds(elevated),
        })
    return success_response(catalog)


@computers_bp.route('/policies/effective/<int:asset_id>', methods=['GET'])
@require_permission('computers.view')
def get_effective_policy(asset_id: int):
    """Preview the resolved effective policy for one endpoint (debug/UI)."""
    gate = _feature_gate()
    if gate:
        return gate
    from ..services.policyresolver import effective_policy_for
    effective = effective_policy_for(asset_id)
    return success_response(effective.to_dict())


@computers_bp.route('/asset/<int:asset_id>/policypanel', methods=['GET'])
@require_permission('computers.view')
def policy_panel(asset_id: int):
    """Keyvalue panel: which policy governs this endpoint, and what it allows.

    Provenance, not a control. It matters because the effective policy already
    narrows the command allowlist, so it is the answer to "why is Start greyed
    out on this PC" - which is otherwise invisible.

    Returns an EMPTY field list rather than the feature-gate 404 when the
    feature is off. The panel contract hides a card with no fields; an error
    would render a broken card on every site that has not enabled policies,
    which is most of them.
    """
    if not policy_flag_enabled():
        return success_response({'fields': []})

    from ..services.policyresolver import effective_policy_for
    effective = effective_policy_for(asset_id)
    actions = effective.to_dict()
    if not actions:
        return success_response({'fields': []})

    # One endpoint resolves through one winning business policy, but read the
    # ids off the actions rather than assuming: a fold can draw from more than
    # one configuration policy.
    businesspolicyids = {a['businesspolicyid'] for a in actions.values()
                         if a.get('businesspolicyid')}
    configpolicyids = {a['configurationpolicyid'] for a in actions.values()
                       if a.get('configurationpolicyid')}

    names = []
    if businesspolicyids:
        names = [p.name for p in BusinessPolicy.query
                 .filter(BusinessPolicy.businesspolicyid.in_(businesspolicyids)).all()]

    gated = sum(1 for a in actions.values() if a.get('mode') == ACTION_MODE_GATE)
    desired = sum(1 for a in actions.values() if a.get('mode') == ACTION_MODE_DESIRED)

    fields = []
    if names:
        fields.append({'label': 'Policy', 'value': ', '.join(sorted(names))})
    fields.append({'label': 'Configuration policies', 'value': str(len(configpolicyids))})
    fields.append({'label': 'Allowed actions', 'value': str(gated)})
    fields.append({'label': 'Desired state', 'value': str(desired)})
    return success_response({'fields': fields})