import logging
from fastapi import APIRouter, Depends, HTTPException, status
from app.core.auth.models import RBACSettingsSchema, UserSession
from app.core.auth.role_resolver import load_rbac_settings, save_rbac_settings
from app.core.auth.dependencies import require_admin

logger = logging.getLogger(__name__)

router = APIRouter(prefix="/settings", tags=["Settings & Access Control"])


@router.get("/rbac", response_model=RBACSettingsSchema, summary="Get Dynamic RBAC Role & Group Mappings")
def get_rbac_configuration():
    """
    Retrieve current dynamic role and group mappings.
    Available to authenticated users to know role configurations.
    """
    return load_rbac_settings()


@router.put("/rbac", response_model=RBACSettingsSchema, summary="Update Dynamic RBAC Role & Group Mappings (Admin Only)")
def update_rbac_configuration(
    payload: RBACSettingsSchema,
    admin_user: UserSession = Depends(require_admin)
):
    """
    Update dynamic role and group mappings.
    STRICTLY RESTRICTED to Administrator / Superadmin.
    Immediately applies changes across the platform (Hot-Reload).
    """
    try:
        updated = save_rbac_settings(payload, author=admin_user.username)
        return updated
    except Exception as e:
        logger.error(f"Failed to update RBAC configuration: {e}")
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail=f"Gagal menyimpan konfigurasi pengaturan hak akses: {str(e)}"
        )