from __future__ import annotations

from dataclasses import replace
from pathlib import Path

from sqlalchemy import inspect

from govoplan_addresses.backend.capabilities import (
    CAPABILITY_ADDRESSES_CONTACT_WRITER,
    CAPABILITY_ADDRESSES_LOOKUP,
    CAPABILITY_ADDRESSES_RECIPIENT_SOURCE,
)
from govoplan_addresses.backend.db import models as addresses_models  # noqa: F401 - populate address ORM metadata
from govoplan_core.core.access import CAPABILITY_AUTH_PERMISSION_EVALUATOR, CAPABILITY_AUTH_PRINCIPAL_RESOLVER
from govoplan_core.core.module_guards import drop_table_retirement_provider, persistent_table_uninstall_guard
from govoplan_core.core.modules import (
    DocumentationTopic,
    FrontendModule,
    FrontendRoute,
    MigrationSpec,
    ModuleContext,
    ModuleInterfaceProvider,
    ModuleManifest,
    NavItem,
    PermissionDefinition,
    RoleTemplate,
)
from govoplan_core.db.base import Base


_addresses_table_retirement_provider = drop_table_retirement_provider(
    addresses_models.AddressSyncDiagnostic,
    addresses_models.AddressSyncConflict,
    addresses_models.AddressSyncTombstone,
    addresses_models.AddressSyncSource,
    addresses_models.AddressListEntry,
    addresses_models.AddressList,
    addresses_models.ContactPostalAddress,
    addresses_models.ContactPhone,
    addresses_models.ContactEmail,
    addresses_models.Contact,
    addresses_models.AddressBook,
    label="Addresses",
)


def _addresses_retirement_provider(session: object | None, module_id: str):
    plan = _addresses_table_retirement_provider(session, module_id)
    base_executor = plan.destroy_data_executor
    if base_executor is None:
        return plan

    def executor(execute_session: object, execute_module_id: str) -> None:
        if not hasattr(execute_session, "get_bind") or not hasattr(execute_session, "query"):
            raise RuntimeError("No database session is available for Addresses credential retirement.")
        if inspect(execute_session.get_bind()).has_table(addresses_models.AddressSyncSource.__tablename__):
            from govoplan_addresses.backend.service import audit_address_credentials_for_retirement

            audit_address_credentials_for_retirement(execute_session)
        base_executor(execute_session, execute_module_id)

    return replace(
        plan,
        destroy_data_warnings=(
            *plan.destroy_data_warnings,
            "Addresses-owned encrypted connector credentials are audited and deleted with the sync-source table.",
        ),
        destroy_data_executor=executor,
    )


def _permission(scope: str, label: str, description: str) -> PermissionDefinition:
    module_id, resource, action = scope.split(":", 2)
    return PermissionDefinition(
        scope=scope,
        label=label,
        description=description,
        category="Addresses",
        level="tenant",
        module_id=module_id,
        resource=resource,
        action=action,
    )


PERMISSIONS = (
    _permission("addresses:address_book:read", "View address books", "List address books visible to the current principal."),
    _permission("addresses:address_book:write", "Manage address books", "Create and edit local address books."),
    _permission("addresses:address_book:delete", "Delete address books", "Soft-delete local address books."),
    _permission("addresses:address_book:admin", "Administer address books", "Manage system-scoped address books and future sync sources."),
    _permission("addresses:address_list:read", "View address lists", "List reusable address lists and their entries."),
    _permission("addresses:address_list:write", "Manage address lists", "Create and edit reusable address lists."),
    _permission("addresses:address_list:delete", "Delete address lists", "Soft-delete reusable address lists."),
    _permission("addresses:contact:read", "View contacts", "List and lookup contacts in visible address books."),
    _permission("addresses:contact:write", "Manage contacts", "Create and edit local contacts."),
    _permission("addresses:contact:delete", "Delete contacts", "Soft-delete local contacts."),
    _permission("addresses:sync:read", "View address sync", "Inspect address sync sources, conflicts, tombstones, and diagnostics."),
    _permission("addresses:sync:write", "Manage address sync", "Bind address books to external sources and record sync state."),
    _permission("addresses:sync:admin", "Administer address sync", "Administer address sync connectors and future destructive sync operations."),
)


ROLE_TEMPLATES = (
    RoleTemplate(
        slug="address_book_manager",
        name="Address book manager",
        description="Manage visible local address books and contacts.",
        permissions=(
            "addresses:address_book:read",
            "addresses:address_book:write",
            "addresses:address_book:delete",
            "addresses:address_list:read",
            "addresses:address_list:write",
            "addresses:address_list:delete",
            "addresses:contact:read",
            "addresses:contact:write",
            "addresses:contact:delete",
            "addresses:sync:read",
            "addresses:sync:write",
        ),
    ),
    RoleTemplate(
        slug="address_book_reader",
        name="Address book reader",
        description="Read visible address books and contacts.",
        permissions=("addresses:address_book:read", "addresses:address_list:read", "addresses:contact:read", "addresses:sync:read"),
    ),
)


def _tenant_summary(session, tenant_id: str) -> dict[str, int]:
    from govoplan_addresses.backend.db.models import AddressBook, AddressList, AddressSyncSource, Contact

    return {
        "address_books": session.query(AddressBook).filter(AddressBook.tenant_id == tenant_id, AddressBook.deleted_at.is_(None)).count(),
        "address_lists": session.query(AddressList).filter(AddressList.tenant_id == tenant_id, AddressList.deleted_at.is_(None)).count(),
        "contacts": session.query(Contact).filter(Contact.tenant_id == tenant_id, Contact.deleted_at.is_(None)).count(),
        "sync_sources": session.query(AddressSyncSource).filter(AddressSyncSource.tenant_id == tenant_id, AddressSyncSource.enabled.is_(True)).count(),
    }


def _addresses_router(_context: ModuleContext):
    from govoplan_addresses.backend.router import router

    return router


manifest = ModuleManifest(
    id="addresses",
    name="Addresses",
    version="0.1.8",
    required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR),
    optional_dependencies=("campaigns", "mail", "forms", "reporting", "portal", "postbox"),
    provides_interfaces=(
        ModuleInterfaceProvider(name=CAPABILITY_ADDRESSES_LOOKUP, version="0.1.8"),
        ModuleInterfaceProvider(name=CAPABILITY_ADDRESSES_RECIPIENT_SOURCE, version="0.1.8"),
        ModuleInterfaceProvider(name=CAPABILITY_ADDRESSES_CONTACT_WRITER, version="0.1.8"),
    ),
    permissions=PERMISSIONS,
    route_factory=_addresses_router,
    role_templates=ROLE_TEMPLATES,
    tenant_summary_providers=(_tenant_summary,),
    nav_items=(NavItem(path="/address-book", label="Address Book", icon="book-user", required_any=("addresses:contact:read",), order=80),),
    frontend=FrontendModule(
        module_id="addresses",
        package_name="@govoplan/addresses-webui",
        routes=(FrontendRoute(path="/address-book", component="AddressBookPage", required_any=("addresses:contact:read",), order=80),),
        nav_items=(NavItem(path="/address-book", label="Address Book", icon="book-user", required_any=("addresses:contact:read",), order=80),),
    ),
    migration_spec=MigrationSpec(
        module_id="addresses",
        metadata=Base.metadata,
        script_location=str(Path(__file__).with_name("migrations") / "versions"),
        retirement_supported=True,
        retirement_provider=_addresses_retirement_provider,
        retirement_notes="Destructive retirement drops address-owned database tables after the installer captures a database snapshot.",
    ),
    capability_factories={
        CAPABILITY_ADDRESSES_LOOKUP: lambda context: __import__("govoplan_addresses.backend.capabilities", fromlist=["lookup_capability"]).lookup_capability(context),
        CAPABILITY_ADDRESSES_RECIPIENT_SOURCE: lambda context: __import__(
            "govoplan_addresses.backend.capabilities",
            fromlist=["recipient_source_capability"],
        ).recipient_source_capability(context),
        CAPABILITY_ADDRESSES_CONTACT_WRITER: lambda context: __import__(
            "govoplan_addresses.backend.capabilities",
            fromlist=["contact_writer_capability"],
        ).contact_writer_capability(context),
    },
    uninstall_guard_providers=(
        persistent_table_uninstall_guard(
            addresses_models.AddressSyncDiagnostic,
            addresses_models.AddressSyncConflict,
            addresses_models.AddressSyncTombstone,
            addresses_models.AddressSyncSource,
            addresses_models.AddressListEntry,
            addresses_models.AddressList,
            addresses_models.AddressBook,
            addresses_models.Contact,
            addresses_models.ContactEmail,
            addresses_models.ContactPhone,
            addresses_models.ContactPostalAddress,
            label="Addresses",
        ),
    ),
    documentation=(
        DocumentationTopic(
            id="addresses.boundary",
            title="Reusable address ownership",
            summary="Reusable person, organization, household, postal, and email recipient sources belong to the addresses module.",
            body=(
                "Campaigns may keep immutable campaign-local recipient snapshots, but durable address directories, "
                "recipient-source definitions, consent metadata, provenance, deduplication, and import/export workflows "
                "are owned by govoplan-addresses."
            ),
            layer="configured",
            documentation_types=("admin", "user"),
            audience=("tenant_admin", "operator", "module_admin"),
            related_modules=("campaigns", "mail", "forms", "reporting", "portal", "postbox"),
            order=30,
        ),
    ),
)


def get_manifest() -> ModuleManifest:
    return manifest