from fastapi import APIRouter, Depends, Request

from app.auth import require_admin, require_admin_or_user
from app.dependencies import get_store
from app.schemas import UserCreate, UserCreated

router = APIRouter()


@router.get("/admin/request-headers", dependencies=[Depends(require_admin_or_user)])
async def request_headers(request: Request):
    """Discovery: zeigt die eingehenden HTTP-Header + Quell-IP.

    Hilft, hinter dem Reverse-Proxy/SSO den richtigen Identitaets-Header
    (TRUSTED_AUTH_HEADER) festzustellen. Nur fuer Admins.
    """
    return {
        "client": request.client.host if request.client else None,
        "headers": dict(request.headers),
    }


@router.post("/admin/users", response_model=UserCreated, dependencies=[Depends(require_admin)])
async def create_user(payload: UserCreate):
    """Legt einen Nutzer an und gibt das Bearer-Token EINMALIG zurueck."""
    user, token = get_store().create_user(payload.display_name)
    return UserCreated(user_id=user.id, display_name=user.display_name, token=token)


@router.get("/admin/users", dependencies=[Depends(require_admin_or_user)])
async def list_users():
    """Listet die Nutzer (ohne Secrets). Fuer Admins (SSO/ADMIN_USERS) oder ADMIN_API_KEY."""
    return [
        {
            "user_id": u.id,
            "display_name": u.display_name,
            "external_id": u.external_id,
            "created_at": u.created_at,
        }
        for u in get_store().list_users()
    ]