from datetime import datetime
from flask import Blueprint, redirect, url_for, render_template, request, flash
from flask_login import login_user, logout_user, login_required, current_user
from app.extensions import db
from app.models.admin_user import AdminUser

bp = Blueprint('auth', __name__)


@bp.route('/login', methods=['GET', 'POST'])
def login():
    # Portal SSO (nginx headers) handles production login automatically.
    # This route handles direct / standalone access.
    if current_user.is_authenticated:
        return redirect(url_for('dashboard.index'))

    if request.method == 'POST':
        username = request.form.get('username', '').strip()
        password = request.form.get('password', '')
        user = AdminUser.query.filter_by(username=username, is_active=True).first()
        if user and user.check_password(password):
            login_user(user, remember=False)
            user.last_login = datetime.utcnow()
            db.session.commit()
            next_page = request.args.get('next') or url_for('dashboard.index')
            return redirect(next_page)
        flash('Invalid username or password.', 'danger')

    return render_template('auth/login.html')


@bp.route('/logout')
@login_required
def logout():
    logout_user()
    return redirect(url_for('auth.login'))