"""Routes: admin sponsors"""
from datetime import datetime
from flask import flash, redirect, render_template, request, url_for

from nexora.core import app
from nexora.database.connection import execute, query
from nexora.services.uploads import delete_upload, process_image_upload
from nexora.security.permissions import (
    admin_required,
    forbidden_response,
    has_permission,
    permission_required,
)


@app.route("/admin/sponsors", methods=["GET", "POST"])
@admin_required
@permission_required("sponsors_view")
def admin_sponsors():
    if request.method == "POST":
        if not has_permission("sponsors_create"):
            return forbidden_response()
        logo, logo_error = process_image_upload(request.files.get("logo"), category="partners")
        if logo_error:
            flash(logo_error, "danger")
            return redirect(url_for("admin_sponsors"))
        execute(
            """
            INSERT INTO sponsors (name, tier, commitment, website, logo, sort_order, active, created_at)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
            """,
            (
                request.form["name"].strip(),
                "",
                "",
                request.form.get("website", "").strip(),
                logo or "",
                0,
                1 if request.form.get("active") else 0,
                datetime.now().isoformat(timespec="seconds"),
            ),
        )
        flash("Sponsor / partner added.", "success")
        return redirect(url_for("admin_sponsors"))
    sponsors = query("SELECT * FROM sponsors ORDER BY sort_order, id")
    return render_template("admin_sponsors.html", sponsors=sponsors)


@app.route("/admin/sponsors/<int:sponsor_id>/delete", methods=["POST"])
@admin_required
@permission_required("sponsors_delete")
def delete_sponsor(sponsor_id):
    row = query("SELECT logo FROM sponsors WHERE id = ?", (sponsor_id,), one=True)
    if row:
        delete_upload(row["logo"])
    execute("DELETE FROM sponsors WHERE id = ?", (sponsor_id,))
    flash("Sponsor deleted.", "success")
    return redirect(url_for("admin_sponsors"))


@app.route("/admin/sponsors/<int:sponsor_id>/toggle", methods=["POST"])
@admin_required
@permission_required("sponsors_update")
def toggle_sponsor(sponsor_id):
    execute("UPDATE sponsors SET active = 1 - active WHERE id = ?", (sponsor_id,))
    flash("Sponsor visibility updated.", "success")
    return redirect(url_for("admin_sponsors"))


@app.route("/admin/sponsors/<int:sponsor_id>/edit", methods=["POST"])
@admin_required
@permission_required("sponsors_update")
def edit_sponsor(sponsor_id):
    row = query("SELECT logo FROM sponsors WHERE id = ?", (sponsor_id,), one=True)
    if not row:
        flash("Sponsor not found.", "danger")
        return redirect(url_for("admin_sponsors"))
    name = request.form.get("name", "").strip()
    website = request.form.get("website", "").strip()
    active = 1 if request.form.get("active") else 0
    if not name:
        flash("Sponsor name is required.", "danger")
        return redirect(url_for("admin_sponsors"))
    new_logo, logo_error = process_image_upload(request.files.get("logo"), category="partners")
    if logo_error:
        flash(logo_error, "danger")
        return redirect(url_for("admin_sponsors"))
    if new_logo:
        delete_upload(row["logo"])
        logo = new_logo
    else:
        logo = row["logo"]
    execute(
        "UPDATE sponsors SET name = ?, website = ?, logo = ?, active = ? WHERE id = ?",
        (name, website, logo, active, sponsor_id),
    )
    flash("Sponsor updated.", "success")
    return redirect(url_for("admin_sponsors"))