from fastapi import APIRouter, Depends, HTTPException, Request, status
from sqlalchemy.orm import Session
from app.models.database import get_db
from app.models.client import Client
from app.security.auth import verify_api_key, create_access_token
from app.security.rate_limit import limiter
from app.schemas.api import TokenRequest, TokenResponse
import json

router = APIRouter(tags=["auth"])


@router.post("/auth/token", response_model=TokenResponse)
@limiter.limit("10/minute")
def get_token(request: Request, body: TokenRequest, db: Session = Depends(get_db)):
    clients = db.query(Client).filter(
        Client.active == True,  # noqa: E712
        Client.deleted_at == None,  # noqa: E711
    ).all()

    matched = None
    for c in clients:
        if verify_api_key(body.api_key, c.api_key_hash):
            matched = c
            break

    if not matched:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="API Key inválida",
        )

    try:
        scopes = json.loads(matched.scopes)
    except Exception:
        scopes = ["convert"]

    token = create_access_token(client_id=matched.id, scopes=scopes)
    return TokenResponse(
        access_token=token,
        client_id=matched.id,
    )