from flask import Blueprint, render_template, session, redirect, url_for, jsonify, request
import sqlite3
import secrets

user_bp = Blueprint('user', __name__)

def get_db_connection():
    conn = sqlite3.connect('pt_manager.db')
    conn.row_factory = sqlite3.Row
    return conn

@user_bp.route('/user')
def user_index():
    if 'user_id' not in session:
        return redirect(url_for('auth.login'))
    
    if session['role'] != 'admin':
        return redirect(url_for('main.index'))
    
    conn = get_db_connection()
    users = conn.execute('SELECT id, username, role, created_at FROM users').fetchall()
    conn.close()
    
    return render_template('user/index.html', users=users)

@user_bp.route('/user/add', methods=['POST'])
def add_user():
    if 'user_id' not in session:
        return jsonify({'error': 'Authentication required'}), 401
    
    if session['role'] != 'admin':
        return jsonify({'error': 'Admin access required'}), 403
    
    username = request.form.get('username')
    role = request.form.get('role', 'user')
    
    if not username:
        return jsonify({'error': 'Username is required'}), 400
    
    # Generate a random password
    password = secrets.token_hex(8)
    
    conn = get_db_connection()
    try:
        conn.execute(
            'INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)',
            (username, password, role)
        )
        conn.commit()
        conn.close()
        return jsonify({'success': True, 'username': username, 'password': password})
    except sqlite3.IntegrityError:
        conn.close()
        return jsonify({'error': 'Username already exists'}), 400
    except Exception as e:
        conn.close()
        return jsonify({'error': str(e)}), 500

@user_bp.route('/user/delete/<int:user_id>', methods=['POST'])
def delete_user(user_id):
    if 'user_id' not in session:
        return jsonify({'error': 'Authentication required'}), 401
    
    if session['role'] != 'admin':
        return jsonify({'error': 'Admin access required'}), 403
    
    # Prevent deleting oneself
    if user_id == session['user_id']:
        return jsonify({'error': 'Cannot delete yourself'}), 400
    
    conn = get_db_connection()
    try:
        conn.execute('DELETE FROM users WHERE id = ?', (user_id,))
        conn.commit()
        conn.close()
        return jsonify({'success': True})
    except Exception as e:
        conn.close()
        return jsonify({'error': str(e)}), 500