from __future__ import annotations

from typing import Annotated

from fastapi import Depends
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
from sqlalchemy.orm import Session

from app.core.exceptions import ForbiddenError, UnauthorizedError
from app.core.security import decode_access_token
from app.db.session import get_db
from app.models.user import RoleEnum, User
from app.services.auth_service import AuthService

bearer_scheme = HTTPBearer(
    scheme_name="BearerAuth",
    description="JWT token from /api/v1/auth/login",
)


def get_current_user(
    db: Annotated[Session, Depends(get_db)],
    credentials: Annotated[HTTPAuthorizationCredentials, Depends(bearer_scheme)],
) -> User:
    token_payload = decode_access_token(credentials.credentials)
    user = AuthService(db).get_user_by_id(token_payload.user_id)
    if user is None or not user.is_active:
        raise UnauthorizedError("Could not validate credentials")
    return user


def get_current_shop(
    current_user: Annotated[User, Depends(get_current_user)],
) -> User:
    if current_user.role != RoleEnum.shop:
        raise ForbiddenError("Shop privileges are required")
    return current_user