ERP/backend/app/routers/users.py

"""Users — profile + role assignment + organization management (v2.6, Casdoor-backed).

Organization panel endpoints (admin / procurement manager — same person):
- GET  /users                — list every user with role + assigned project.
- POST /users                — define a new user (manual identity, casdoor_id optional).
- PATCH /users/{id}          — set/clear role; clearing (or switching away from
                               «pm») also unassigns the user from their project.
- POST /users/{id}/project   — assign/unassign the user's single project
                               (project_id=None unassigns; one PM per project).

Role management is open to BOTH «admin» and «procurement_manager» (they are
the same person in this system), unlike the plain require_role("admin").
"""
import uuid

from fastapi import APIRouter, Depends
from sqlalchemy import select, update
from sqlalchemy.ext.asyncio import AsyncSession

from app.auth import UserContext, get_current_user
from app.db.engine import get_db
from app.models.procurement import Project, User
from app.schemas.procurement import UserCreate, UserProjectUpdate, UserRoleUpdate
from app.utils.errors import ConflictError, ForbiddenError, NotFoundError, ValidationError
from app.utils.serialization import to_iso

router = APIRouter(prefix="/users", tags=["users"])

USER_ROLE_LABELS = {
    "pm": "مدیر پروژه",
    "procurement_manager": "مدیر تدارکات",
    "admin": "ادمین",
}


def user_to_dict(user: User, project: Project | None = None) -> dict:
    return {
        "id": str(user.id),
        "casdoor_id": user.casdoor_id,
        "first_name": user.first_name,
        "last_name": user.last_name,
        "phone": user.phone,
        "role": user.role,
        "role_label": USER_ROLE_LABELS.get(user.role) if user.role else None,
        "project_id": str(project.id) if project else None,
        "project_name": project.name if project else None,
        "created_at": to_iso(user.created_at),
    }


async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserContext:
    """Admin OR procurement manager (the same person) — organization management."""
    if ctx.role not in ("admin", "procurement_manager"):
        raise ForbiddenError("دسترسی به این بخش برای نقش شما مجاز نیست")
    return ctx


async def _user_project(db: AsyncSession, user: User) -> Project | None:
    if user.role != "pm":
        return None
    return await db.scalar(select(Project).where(Project.pm_user_id == user.id))


async def _unassign_projects(db: AsyncSession, user_id) -> None:
    """Clear the user's pm assignment on every project (one project per PM)."""
    await db.execute(
        update(Project).where(Project.pm_user_id == user_id).values(pm_user_id=None)
    )


@router.get("/me")
async def me(ctx: UserContext = Depends(get_current_user), db: AsyncSession = Depends(get_db)):
    project = await _user_project(db, ctx.user) if ctx.role == "pm" else None
    return {"data": user_to_dict(ctx.user, project)}


@router.get("")
async def list_users(
    _: UserContext = Depends(_org_manager),
    db: AsyncSession = Depends(get_db),
):
    """Every user (with role + assigned project) — Organization panel."""
    users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
    pm_ids = {u.id for u in users if u.role == "pm"}
    projects: dict = {}
    if pm_ids:
        projs = (await db.execute(select(Project).where(Project.pm_user_id.in_(pm_ids)))).scalars().all()
        projects = {p.pm_user_id: p for p in projs}
    return {
        "data": [user_to_dict(u, projects.get(u.id)) for u in users],
        "meta": {"total": len(users)},
    }


@router.post("", status_code=201)
async def create_user(
    payload: UserCreate,
    _: UserContext = Depends(_org_manager),
    db: AsyncSession = Depends(get_db),
):
    """Define a new user (manual identity — casdoor_id optional)."""
    casdoor_id = (payload.casdoor_id or "").strip() or f"manual-{uuid.uuid4()}"
    duplicate = await db.scalar(select(User).where(User.casdoor_id == casdoor_id))
    if duplicate is not None:
        raise ConflictError("کاربری با این شناسه قبلاً ثبت شده است", field="casdoor_id")
    user = User(
        casdoor_id=casdoor_id,
        first_name=payload.first_name,
        last_name=payload.last_name or "",
        phone=payload.phone,
        role=payload.role,
    )
    db.add(user)
    await db.flush()
    return {"data": user_to_dict(user)}


@router.patch("/{user_id}")
async def update_user_role(
    user_id,
    payload: UserRoleUpdate,
    _: UserContext = Depends(_org_manager),
    db: AsyncSession = Depends(get_db),
):
    """Set/clear a role. Revoking (or switching away from «pm») unassigns projects."""
    user = await db.get(User, user_id)
    if user is None:
        raise NotFoundError("کاربر یافت نشد")
    if user.role == "pm" and payload.role != "pm":
        await _unassign_projects(db, user.id)
    user.role = payload.role
    await db.flush()
    project = await _user_project(db, user)
    return {"data": user_to_dict(user, project)}


@router.post("/{user_id}/project")
async def assign_user_project(
    user_id,
    payload: UserProjectUpdate,
    _: UserContext = Depends(_org_manager),
    db: AsyncSession = Depends(get_db),
):
    """Assign the user as PM of one project (project_id=None unassigns).

    Rules: the user must hold the «pm» role; a PM manages ONE project at a
    time (assignment on other projects is cleared); assigning a new PM to a
    project replaces the previous PM there.
    """
    user = await db.get(User, user_id)
    if user is None:
        raise NotFoundError("کاربر یافت نشد")
    if user.role != "pm":
        raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="role")

    await _unassign_projects(db, user.id)
    if payload.project_id is None:
        await db.flush()
        return {"data": user_to_dict(user)}

    project = await db.get(Project, payload.project_id)
    if project is None:
        raise NotFoundError("پروژه یافت نشد", field="project_id")
    project.pm_user_id = user.id
    await db.flush()
    return {"data": user_to_dict(user, project)}