resolutionflow/backend/app/api/endpoints/accounts.py

from datetime import datetime, timezone, timedelta
from typing import Annotated, Optional
from uuid import UUID
import secrets
import string
from fastapi import APIRouter, Depends, HTTPException, status, Query
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select

from app.core.database import get_db
from app.core.subscriptions import get_account_subscription, get_plan_limits, get_account_usage
from app.models.account import Account
from app.models.account_invite import AccountInvite
from app.models.subscription import Subscription
from app.models.user import User
from app.schemas.account import AccountResponse, AccountUpdate, AccountInviteCreate, AccountInviteResponse
from app.schemas.subscription import SubscriptionResponse, PlanLimitsResponse, UsageResponse, SubscriptionDetails
from app.schemas.user import UserResponse, AccountRoleUpdate
from app.api.deps import get_current_active_user, require_account_owner

router = APIRouter(prefix="/accounts", tags=["accounts"])


@router.get("/me", response_model=AccountResponse)
async def get_my_account(
    db: Annotated[AsyncSession, Depends(get_db)],
    current_user: Annotated[User, Depends(get_current_active_user)]
):
    """Get current user's account."""
    result = await db.execute(
        select(Account).where(Account.id == current_user.account_id)
    )
    account = result.scalar_one_or_none()
    if not account:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="Account not found"
        )
    return account


@router.get("/me/subscription", response_model=SubscriptionDetails)
async def get_my_subscription(
    db: Annotated[AsyncSession, Depends(get_db)],
    current_user: Annotated[User, Depends(get_current_active_user)]
):
    """Get current user's subscription details including limits and usage."""
    sub = await get_account_subscription(current_user.account_id, db)
    if not sub:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="No subscription found"
        )

    limits = await get_plan_limits(sub.plan, db)
    if not limits:
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail="Plan limits not configured"
        )

    usage = await get_account_usage(current_user.account_id, db)

    return SubscriptionDetails(
        subscription=SubscriptionResponse.model_validate(sub),
        limits=PlanLimitsResponse.model_validate(limits),
        usage=UsageResponse(**usage),
    )


@router.get("/me/members", response_model=list[UserResponse])
async def get_my_members(
    db: Annotated[AsyncSession, Depends(get_db)],
    current_user: Annotated[User, Depends(get_current_active_user)]
):
    """Get members of current user's account."""
    result = await db.execute(
        select(User).where(User.account_id == current_user.account_id)
        .order_by(User.created_at)
    )
    return result.scalars().all()


@router.patch("/me", response_model=AccountResponse)
async def update_my_account(
    data: AccountUpdate,
    db: Annotated[AsyncSession, Depends(get_db)],
    current_user: Annotated[User, Depends(require_account_owner)]
):
    """Update account settings (owner only)."""
    result = await db.execute(
        select(Account).where(Account.id == current_user.account_id)
    )
    account = result.scalar_one_or_none()
    if not account:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="Account not found"
        )

    update_data = data.model_dump(exclude_unset=True)
    for field, value in update_data.items():
        setattr(account, field, value)

    await db.commit()
    await db.refresh(account)
    return account


@router.patch("/me/members/{user_id}/role", response_model=UserResponse)
async def update_member_role(
    user_id: UUID,
    data: AccountRoleUpdate,
    db: Annotated[AsyncSession, Depends(get_db)],
    current_user: Annotated[User, Depends(require_account_owner)]
):
    """Change a member's role within the account (owner only)."""
    result = await db.execute(
        select(User).where(
            User.id == user_id,
            User.account_id == current_user.account_id
        )
    )
    user = result.scalar_one_or_none()
    if not user:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="User not found in your account"
        )

    if user.id == current_user.id:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Cannot change your own role"
        )

    user.account_role = data.account_role
    await db.commit()
    await db.refresh(user)
    return user


@router.delete("/me/members/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
async def remove_member(
    user_id: UUID,
    db: Annotated[AsyncSession, Depends(get_db)],
    current_user: Annotated[User, Depends(require_account_owner)]
):
    """Remove a member from the account (owner only).

    The removed user gets a new personal account.
    """
    result = await db.execute(
        select(User).where(
            User.id == user_id,
            User.account_id == current_user.account_id
        )
    )
    user = result.scalar_one_or_none()
    if not user:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="User not found in your account"
        )

    if user.id == current_user.id:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Cannot remove yourself from your own account"
        )

    # Create a personal account for the removed user
    chars = string.ascii_uppercase + string.digits
    display_code = ''.join(secrets.choice(chars) for _ in range(8))

    new_account = Account(
        name=f"{user.name}'s Account",
        display_code=display_code,
        owner_id=user.id,
    )
    db.add(new_account)
    await db.flush()

    new_sub = Subscription(
        account_id=new_account.id,
        plan="free",
        status="active",
    )
    db.add(new_sub)

    user.account_id = new_account.id
    user.account_role = "owner"

    await db.commit()
    return None


@router.post("/me/invites", response_model=AccountInviteResponse, status_code=status.HTTP_201_CREATED)
async def create_invite(
    data: AccountInviteCreate,
    db: Annotated[AsyncSession, Depends(get_db)],
    current_user: Annotated[User, Depends(require_account_owner)]
):
    """Create an invite to join this account (owner only)."""
    code = secrets.token_urlsafe(16)

    expires_at = None
    if data.expires_in_days:
        expires_at = datetime.now(timezone.utc) + timedelta(days=data.expires_in_days)

    invite = AccountInvite(
        account_id=current_user.account_id,
        invited_by_id=current_user.id,
        email=data.email,
        code=code,
        role=data.role,
        expires_at=expires_at,
    )
    db.add(invite)
    await db.commit()
    await db.refresh(invite)
    return invite


@router.get("/me/invites", response_model=list[AccountInviteResponse])
async def list_invites(
    db: Annotated[AsyncSession, Depends(get_db)],
    current_user: Annotated[User, Depends(require_account_owner)]
):
    """List invites for this account (owner only)."""
    result = await db.execute(
        select(AccountInvite)
        .where(AccountInvite.account_id == current_user.account_id)
        .order_by(AccountInvite.created_at.desc())
    )
    return result.scalars().all()