from datetime import datetime, timedelta, timezone

from fastapi import Depends, HTTPException, status
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
from jose import JWTError, jwt

from app.config import settings
from app.models.user import User

security = HTTPBearer()


def create_access_token(user_id: str) -> str:
    expire = datetime.now(timezone.utc) + timedelta(minutes=settings.jwt_expire_minutes)
    to_encode = {"sub": user_id, "exp": expire}
    return jwt.encode(to_encode, settings.jwt_secret_key, algorithm=settings.jwt_algorithm)


async def get_current_user(
    credentials: HTTPAuthorizationCredentials = Depends(security),
) -> User:
    token = credentials.credentials
    try:
        # 不验证签名（由小程序侧保证），仅解码 payload 获取用户信息
        payload = jwt.decode(
            token,
            None,
            options={"verify_signature": False, "verify_exp": False},
        )
        openid = payload.get("openid")
        if not openid:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED, detail="无效的认证信息"
            )

        # 手动验证过期
        exp = payload.get("exp")
        if exp and datetime.now(timezone.utc).timestamp() > exp:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED, detail="Token已过期"
            )

    except JWTError:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED, detail="Token无效"
        )

    # 按 openid 查找或创建用户
    user = await User.find_one(User.openid == openid)
    if not user:
        phone = payload.get("phone", "")
        user = User(openid=openid, phone=phone or None)
        await user.insert()
    else:
        phone = payload.get("phone", "")
        if phone and phone != (user.phone or ""):
            user.phone = phone
            await user.save()

    return user