"""Routes: admin media"""
from datetime import datetime
from flask import flash, redirect, render_template, request, url_for

from nexora.core import app
from nexora.database.connection import execute, query
from nexora.services.uploads import delete_upload, process_image_upload
from nexora.security.permissions import (
    admin_required,
    forbidden_response,
    has_permission,
    permission_required,
)


@app.route("/admin/media", methods=["GET", "POST"])
@admin_required
@permission_required("media_view")
def admin_media():
    if request.method == "POST":
        if not has_permission("media_create"):
            return forbidden_response()
        media_kind = request.form.get("kind", "gallery")
        media_category = "home" if media_kind == "hero" else "gallery"
        image, image_error = process_image_upload(request.files.get("image"), category=media_category)
        if image_error:
            flash(image_error, "danger")
            return redirect(url_for("admin_media"))
        if image:
            execute(
                "INSERT INTO media (kind, title, caption, image, created_at) VALUES (?, ?, ?, ?, ?)",
                (
                    request.form["kind"],
                    request.form["title"].strip(),
                    request.form.get("caption", "").strip(),
                    image,
                    datetime.now().isoformat(timespec="seconds"),
                ),
            )
            flash("Image uploaded.", "success")
        else:
            flash("Please select a file to upload.", "danger")
        return redirect(url_for("admin_media"))

    hero = query("SELECT * FROM media WHERE kind = 'hero' ORDER BY id DESC")
    gallery_items = query("SELECT * FROM media WHERE kind = 'gallery' ORDER BY id DESC")
    return render_template("admin_media.html", hero=hero, gallery_items=gallery_items)


@app.route("/admin/media/<int:media_id>/edit", methods=["POST"])
@admin_required
@permission_required("media_update")
def edit_media(media_id):
    row = query("SELECT * FROM media WHERE id = ?", (media_id,), one=True)
    if not row:
        flash("Image not found.", "danger")
        return redirect(url_for("admin_media"))
    title = request.form.get("title", "").strip()
    caption = request.form.get("caption", "").strip()
    if not title:
        flash("Title is required.", "danger")
        return redirect(url_for("admin_media"))
    raw_image = request.files.get("image")
    image = row["image"]
    if raw_image and raw_image.filename:
        media_category = "home" if row["kind"] == "hero" else "gallery"
        new_image, image_error = process_image_upload(raw_image, category=media_category)
        if image_error:
            flash(image_error, "danger")
            return redirect(url_for("admin_media"))
        if new_image:
            delete_upload(row["image"])
            image = new_image
    execute("UPDATE media SET title = ?, caption = ?, image = ? WHERE id = ?", (title, caption, image, media_id))
    flash("Image updated.", "success")
    return redirect(url_for("admin_media"))


@app.route("/admin/media/<int:media_id>/delete", methods=["POST"])
@admin_required
@permission_required("media_delete")
def delete_media(media_id):
    row = query("SELECT image FROM media WHERE id = ?", (media_id,), one=True)
    if row:
        delete_upload(row["image"])
    execute("DELETE FROM media WHERE id = ?", (media_id,))
    flash("Image deleted.", "success")
    return redirect(url_for("admin_media"))