"""
System Audit and Security Telemetry API router.
"""

from typing import Annotated
from uuid import UUID

from fastapi import APIRouter, Depends, Query, status
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.auth_deps import require_permission
from app.core.dependencies import get_db
from app.core.permissions import PermissionCode
from app.core.responses import PaginatedResponse, PaginationMeta, SuccessResponse
from app.models.user import User
from app.schemas.audit import AuditLogResponse, AuditMetricsResponse
from app.services.audit_service import AuditService
from app.services.dashboard_service import DashboardService

router = APIRouter(prefix="/audit-logs", tags=["Audit & Security"])
_service = AuditService()


@router.get(
    "",
    response_model=PaginatedResponse[AuditLogResponse],
    status_code=status.HTTP_200_OK,
    summary="List system audit logs",
    description="Query chronological system and security audit trail events.",
)
async def list_audit_logs(
    db: Annotated[AsyncSession, Depends(get_db)],
    current_user: Annotated[User, Depends(require_permission(PermissionCode.AUDIT_READ))],
    category: Annotated[
        str | None, Query(description="Filter by category (SECURITY, CLINICAL, BILLING, ADMIN, SYSTEM)")
    ] = None,
    severity: Annotated[str | None, Query(description="Filter by severity (INFO, WARNING, CRITICAL)")] = None,
    search: Annotated[str | None, Query(description="Search term in description, action, or actor")] = None,
    page: Annotated[int, Query(ge=1)] = 1,
    limit: Annotated[int, Query(ge=1, le=200)] = 50,
    lab_id: UUID | None = Query(None, description="Optional branch lab ID"),
) -> PaginatedResponse[AuditLogResponse]:
    lab_id = DashboardService().resolve_tenant_lab_id(current_user, lab_id)
    offset = (page - 1) * limit
    items, total = await _service.list_logs(
        db, lab_id=lab_id, category=category, severity=severity, search=search, limit=limit, offset=offset
    )
    total_pages = max(1, (total + limit - 1) // limit)
    meta = PaginationMeta(page=page, limit=limit, total=total, pages=total_pages)
    return PaginatedResponse(data=items, meta=meta)


@router.get(
    "/metrics",
    response_model=SuccessResponse[AuditMetricsResponse],
    status_code=status.HTTP_200_OK,
    summary="Get audit telemetry metrics",
)
async def get_audit_metrics(
    db: Annotated[AsyncSession, Depends(get_db)],
    current_user: Annotated[User, Depends(require_permission(PermissionCode.AUDIT_READ))],
    lab_id: UUID | None = Query(None, description="Optional branch lab ID"),
) -> SuccessResponse[AuditMetricsResponse]:
    lab_id = DashboardService().resolve_tenant_lab_id(current_user, lab_id)
    metrics = await _service.get_metrics(db, lab_id=lab_id)
    return SuccessResponse(data=metrics)