"""Session-cookie dependencies. Handlers stay thin; DB via app.db.get_db."""

from __future__ import annotations

from typing import Annotated

from fastapi import Depends, HTTPException, Request
from sqlmodel import Session

from app.db import get_db
from app.models import User

from . import service

SESSION_COOKIE = "kirche_session"
SESSION_MAX_AGE = int(service.SESSION_TTL.total_seconds())


def get_optional_user(
    request: Request, session: Annotated[Session, Depends(get_db)]
) -> User | None:
    token = request.cookies.get(SESSION_COOKIE)
    if not token:
        return None
    return service.get_token_user(session, token)


def get_current_user(request: Request, session: Annotated[Session, Depends(get_db)]) -> User:
    user = get_optional_user(request, session)
    if user is None:
        raise HTTPException(status_code=401, detail="not authenticated")
    return user


def require_admin(user: Annotated[User, Depends(get_current_user)]) -> User:
    if user.role != "admin":
        raise HTTPException(status_code=403, detail="admin only")
    return user


def resolve_tenant(user: User | None, explicit: str | None, default: str = "default") -> str:
    """Tenant comes from the session; the body/query param is a deprecated
    fallback for unauthenticated callers."""
    if user is not None:
        return user.tenant_id
    return explicit or default