"""Routes: admin leaders"""
from datetime import datetime
from flask import flash, redirect, render_template, request, url_for

from nexora.core import app
from nexora.database.connection import execute, query
from nexora.services.uploads import delete_upload, process_image_upload
from nexora.security.permissions import (
    admin_required,
    forbidden_response,
    has_permission,
    permission_required,
)


@app.route("/admin/leaders", methods=["GET", "POST"])
@admin_required
@permission_required("leadership_view")
def admin_leaders():
    if request.method == "POST":
        if not has_permission("leadership_create"):
            return forbidden_response()
        image, image_error = process_image_upload(request.files.get("image"), category="leadership")
        if image_error:
            flash(image_error, "danger")
            return redirect(url_for("admin_leaders"))
        execute(
            """
            INSERT INTO leaders (name, role, quote, image, sort_order, active, created_at)
            VALUES (?, ?, ?, ?, ?, ?, ?)
            """,
            (
                request.form["name"].strip(),
                request.form["role"].strip(),
                request.form["quote"].strip(),
                image or "",
                request.form.get("sort_order", type=int) or 0,
                1 if request.form.get("active") else 0,
                datetime.now().isoformat(timespec="seconds"),
            ),
        )
        flash("Leadership quote added.", "success")
        return redirect(url_for("admin_leaders"))
    leaders = query("SELECT * FROM leaders ORDER BY sort_order, id")
    return render_template("admin_leaders.html", leaders=leaders)


@app.route("/admin/leaders/<int:leader_id>/update", methods=["POST"])
@admin_required
@permission_required("leadership_update")
def update_leader(leader_id):
    existing = query("SELECT * FROM leaders WHERE id = ?", (leader_id,), one=True)
    if not existing:
        flash("Entry not found.", "danger")
        return redirect(url_for("admin_leaders"))

    image, image_error = process_image_upload(request.files.get("image"), category="leadership")
    if image_error:
        flash(image_error, "danger")
        return redirect(url_for("admin_leaders"))
    if image and existing["image"]:
        delete_upload(existing["image"])

    execute(
        """
        UPDATE leaders SET name = ?, role = ?, quote = ?, image = ?, sort_order = ?, active = ?
        WHERE id = ?
        """,
        (
            request.form["name"].strip(),
            request.form["role"].strip(),
            request.form["quote"].strip(),
            image or existing["image"],
            request.form.get("sort_order", type=int) or 0,
            1 if request.form.get("active") else 0,
            leader_id,
        ),
    )
    flash("Leadership entry updated.", "success")
    return redirect(url_for("admin_leaders"))


@app.route("/admin/leaders/<int:leader_id>/delete", methods=["POST"])
@admin_required
@permission_required("leadership_delete")
def delete_leader(leader_id):
    row = query("SELECT image FROM leaders WHERE id = ?", (leader_id,), one=True)
    if row:
        delete_upload(row["image"])
    execute("DELETE FROM leaders WHERE id = ?", (leader_id,))
    flash("Leadership entry deleted.", "success")
    return redirect(url_for("admin_leaders"))