"""Routes: admin team"""
from datetime import datetime
from flask import flash, redirect, render_template, request, url_for

from nexora.core import app
from nexora.database.connection import execute, query
from nexora.services.uploads import delete_upload, process_image_upload
from nexora.security.permissions import (
    admin_required,
    forbidden_response,
    has_permission,
    permission_required,
)


@app.route("/admin/team", methods=["GET", "POST"])
@admin_required
@permission_required("team_view")
def admin_team():
    if request.method == "POST":
        if not has_permission("team_create"):
            return forbidden_response()
        title = request.form.get("title", "").strip()
        if not title:
            flash("Section title is required.", "danger")
            return redirect(url_for("admin_team"))
        desc = request.form.get("description", "").strip()
        max_order = query("SELECT COALESCE(MAX(sort_order),0) AS m FROM team_sections", one=True)["m"]
        sec_id = execute(
            "INSERT INTO team_sections (title, description, sort_order, active, created_at) VALUES (?, ?, ?, 1, ?)",
            (title, desc, max_order + 1, datetime.now().isoformat(timespec="seconds")),
        )
        num_rows = max(1, min(10, int(request.form.get("num_rows", 2))))
        for i in range(num_rows):
            direction = request.form.get(f"row_dir_{i}", "ltr")
            speed = max(10, min(120, int(request.form.get(f"row_speed_{i}", 30))))
            execute(
                "INSERT INTO team_rows (section_id, row_index, direction, speed, enabled) VALUES (?, ?, ?, ?, 1)",
                (sec_id, i, direction, speed),
            )
        flash(f'Section "{title}" created.', "success")
        return redirect(url_for("admin_team"))

    sections = query("SELECT * FROM team_sections ORDER BY sort_order, id")
    full = []
    for sec in sections:
        members = query(
            "SELECT * FROM team_members WHERE section_id = ? ORDER BY sort_order, id",
            (sec["id"],),
        )
        rows = query(
            "SELECT * FROM team_rows WHERE section_id = ? ORDER BY row_index",
            (sec["id"],),
        )
        full.append({"section": sec, "members": members, "rows": rows})
    return render_template("admin_team.html", team_data=full)


@app.route("/admin/team/section/<int:sec_id>/edit", methods=["POST"])
@admin_required
@permission_required("team_update")
def edit_team_section(sec_id):
    sec = query("SELECT * FROM team_sections WHERE id = ?", (sec_id,), one=True)
    if not sec:
        flash("Section not found.", "danger")
        return redirect(url_for("admin_team"))
    title = request.form.get("title", "").strip()
    if not title:
        flash("Title is required.", "danger")
        return redirect(url_for("admin_team"))
    desc = request.form.get("description", "").strip()
    active = 1 if request.form.get("active") else 0
    execute("UPDATE team_sections SET title = ?, description = ?, active = ? WHERE id = ?",
            (title, desc, active, sec_id))
    num_rows = max(1, min(10, int(request.form.get("num_rows", 2))))
    existing = {r["row_index"]: r for r in query("SELECT * FROM team_rows WHERE section_id = ?", (sec_id,))}
    for i in range(num_rows):
        direction = request.form.get(f"row_dir_{i}", "ltr")
        speed = max(10, min(120, int(request.form.get(f"row_speed_{i}", 30))))
        enabled = 1 if request.form.get(f"row_enabled_{i}") is not None else 0
        if i in existing:
            execute("UPDATE team_rows SET direction = ?, speed = ?, enabled = ? WHERE id = ?",
                    (direction, speed, enabled, existing[i]["id"]))
        else:
            execute("INSERT INTO team_rows (section_id, row_index, direction, speed, enabled) VALUES (?, ?, ?, ?, ?)",
                    (sec_id, i, direction, speed, enabled))
    for idx, r in existing.items():
        if idx >= num_rows:
            execute("DELETE FROM team_rows WHERE id = ?", (r["id"],))
    flash("Section updated.", "success")
    return redirect(url_for("admin_team"))


@app.route("/admin/team/section/<int:sec_id>/delete", methods=["POST"])
@admin_required
@permission_required("team_delete")
def delete_team_section(sec_id):
    sec = query("SELECT * FROM team_sections WHERE id = ?", (sec_id,), one=True)
    if not sec:
        flash("Section not found.", "danger")
        return redirect(url_for("admin_team"))
    members = query("SELECT image FROM team_members WHERE section_id = ?", (sec_id,))
    for m in members:
        delete_upload(m["image"])
    execute("DELETE FROM team_members WHERE section_id = ?", (sec_id,))
    execute("DELETE FROM team_rows WHERE section_id = ?", (sec_id,))
    execute("DELETE FROM team_sections WHERE id = ?", (sec_id,))
    flash(f'Section "{sec["title"]}" deleted.', "success")
    return redirect(url_for("admin_team"))


@app.route("/admin/team/section/<int:sec_id>/reorder", methods=["POST"])
@admin_required
@permission_required("team_update")
def reorder_team_section(sec_id):
    direction = request.form.get("direction")
    sec = query("SELECT sort_order FROM team_sections WHERE id = ?", (sec_id,), one=True)
    if not sec:
        return redirect(url_for("admin_team"))
    if direction == "up":
        swap = query("SELECT id, sort_order FROM team_sections WHERE sort_order < ? ORDER BY sort_order DESC LIMIT 1",
                     (sec["sort_order"],), one=True)
    else:
        swap = query("SELECT id, sort_order FROM team_sections WHERE sort_order > ? ORDER BY sort_order ASC LIMIT 1",
                     (sec["sort_order"],), one=True)
    if swap:
        execute("UPDATE team_sections SET sort_order = ? WHERE id = ?", (swap["sort_order"], sec_id))
        execute("UPDATE team_sections SET sort_order = ? WHERE id = ?", (sec["sort_order"], swap["id"]))
    flash("Order updated.", "success")
    return redirect(url_for("admin_team"))


@app.route("/admin/team/section/<int:sec_id>/member/add", methods=["POST"])
@admin_required
@permission_required("team_create")
def add_team_member(sec_id):
    sec = query("SELECT id FROM team_sections WHERE id = ?", (sec_id,), one=True)
    if not sec:
        flash("Section not found.", "danger")
        return redirect(url_for("admin_team"))
    name = request.form.get("name", "").strip()
    if not name:
        flash("Member name is required.", "danger")
        return redirect(url_for("admin_team"))
    image, image_error = process_image_upload(request.files.get("image"), category="team")
    if image_error:
        flash(image_error, "danger")
        return redirect(url_for("admin_team"))
    max_order = query("SELECT COALESCE(MAX(sort_order),0) AS m FROM team_members WHERE section_id = ?",
                      (sec_id,), one=True)["m"]
    execute(
        "INSERT INTO team_members (section_id, name, image, sort_order, active, created_at) VALUES (?, ?, ?, ?, 1, ?)",
        (sec_id, name, image or "", max_order + 1, datetime.now().isoformat(timespec="seconds")),
    )
    flash(f'"{name}" added.', "success")
    return redirect(url_for("admin_team"))


@app.route("/admin/team/member/<int:member_id>/edit", methods=["POST"])
@admin_required
@permission_required("team_update")
def edit_team_member(member_id):
    member = query("SELECT * FROM team_members WHERE id = ?", (member_id,), one=True)
    if not member:
        flash("Member not found.", "danger")
        return redirect(url_for("admin_team"))
    name = request.form.get("name", "").strip()
    if not name:
        flash("Name is required.", "danger")
        return redirect(url_for("admin_team"))
    active = 1 if request.form.get("active") else 0
    new_image, image_error = process_image_upload(request.files.get("image"), category="team")
    if image_error:
        flash(image_error, "danger")
        return redirect(url_for("admin_team"))
    if new_image:
        delete_upload(member["image"])
        image = new_image
    else:
        image = member["image"]
    execute("UPDATE team_members SET name = ?, image = ?, active = ? WHERE id = ?",
            (name, image, active, member_id))
    flash("Member updated.", "success")
    return redirect(url_for("admin_team"))


@app.route("/admin/team/member/<int:member_id>/delete", methods=["POST"])
@admin_required
@permission_required("team_delete")
def delete_team_member(member_id):
    member = query("SELECT * FROM team_members WHERE id = ?", (member_id,), one=True)
    if not member:
        flash("Member not found.", "danger")
        return redirect(url_for("admin_team"))
    delete_upload(member["image"])
    execute("DELETE FROM team_members WHERE id = ?", (member_id,))
    flash("Member deleted.", "success")
    return redirect(url_for("admin_team"))


@app.route("/admin/team/member/<int:member_id>/toggle", methods=["POST"])
@admin_required
@permission_required("team_update")
def toggle_team_member(member_id):
    execute("UPDATE team_members SET active = 1 - active WHERE id = ?", (member_id,))
    flash("Member visibility updated.", "success")
    return redirect(url_for("admin_team"))


@app.route("/admin/team/member/<int:member_id>/reorder", methods=["POST"])
@admin_required
@permission_required("team_update")
def reorder_team_member(member_id):
    member = query("SELECT * FROM team_members WHERE id = ?", (member_id,), one=True)
    if not member:
        return redirect(url_for("admin_team"))
    direction = request.form.get("direction")
    if direction == "up":
        swap = query(
            "SELECT id, sort_order FROM team_members WHERE section_id = ? AND sort_order < ? ORDER BY sort_order DESC LIMIT 1",
            (member["section_id"], member["sort_order"]), one=True)
    else:
        swap = query(
            "SELECT id, sort_order FROM team_members WHERE section_id = ? AND sort_order > ? ORDER BY sort_order ASC LIMIT 1",
            (member["section_id"], member["sort_order"]), one=True)
    if swap:
        execute("UPDATE team_members SET sort_order = ? WHERE id = ?", (swap["sort_order"], member_id))
        execute("UPDATE team_members SET sort_order = ? WHERE id = ?", (member["sort_order"], swap["id"]))
    flash("Order updated.", "success")
    return redirect(url_for("admin_team"))