"""Self-service dashboard for MCP bearer tokens.

Mirrors the Themis API-keys flow visually but stores hashed tokens. Plaintext
is shown to the user exactly once (on the create-success page) and never
persisted.
"""

from __future__ import annotations

from django.contrib import messages
from django.contrib.auth.decorators import login_required
from django.http import HttpRequest, HttpResponse
from django.shortcuts import get_object_or_404, redirect, render
from django.views.decorators.http import require_GET, require_http_methods, require_POST

from .forms import MCPTokenCreateForm, MCPTokenEditForm
from .models import MCPToken


@login_required
@require_GET
def mcp_token_list(request: HttpRequest) -> HttpResponse:
    tokens = MCPToken.objects.filter(user=request.user).order_by("-created_at")
    return render(request, "mcp_server/tokens/list.html", {"tokens": tokens})


@login_required
@require_http_methods(["GET", "POST"])
def mcp_token_create(request: HttpRequest) -> HttpResponse:
    if request.method == "POST":
        form = MCPTokenCreateForm(request.POST)
        if form.is_valid():
            token, plaintext = MCPToken.objects.create_token(
                user=request.user,
                name=form.cleaned_data["name"],
                allowed_tools=form.cleaned_data.get("allowed_tools") or [],
                expires_at=form.cleaned_data.get("expires_at") or None,
            )
            return render(
                request,
                "mcp_server/tokens/created.html",
                {"token": token, "plaintext": plaintext},
            )
    else:
        form = MCPTokenCreateForm()

    return render(request, "mcp_server/tokens/create.html", {"form": form})


@login_required
@require_GET
def mcp_token_detail(request: HttpRequest, pk: int) -> HttpResponse:
    token = get_object_or_404(MCPToken, pk=pk, user=request.user)
    return render(request, "mcp_server/tokens/detail.html", {"token": token})


@login_required
@require_http_methods(["GET", "POST"])
def mcp_token_edit(request: HttpRequest, pk: int) -> HttpResponse:
    token = get_object_or_404(MCPToken, pk=pk, user=request.user)

    if request.method == "POST":
        form = MCPTokenEditForm(request.POST, instance=token)
        if form.is_valid():
            instance = form.save(commit=False)
            instance.allowed_tools = form.cleaned_data.get("allowed_tools") or []
            instance.save()
            messages.success(request, "MCP token updated.")
            return redirect("mcp_server:mcp-token-detail", pk=token.pk)
    else:
        form = MCPTokenEditForm(instance=token)

    return render(
        request, "mcp_server/tokens/edit.html", {"form": form, "token": token}
    )


@login_required
@require_POST
def mcp_token_revoke(request: HttpRequest, pk: int) -> HttpResponse:
    token = get_object_or_404(MCPToken, pk=pk, user=request.user)
    token.is_active = False
    token.save(update_fields=["is_active", "updated_at"])
    messages.success(request, f"Revoked “{token.name}”. The token can no longer be used.")
    return redirect("mcp_server:mcp-token-detail", pk=token.pk)


@login_required
@require_POST
def mcp_token_delete(request: HttpRequest, pk: int) -> HttpResponse:
    token = get_object_or_404(MCPToken, pk=pk, user=request.user)
    name = token.name
    token.delete()
    messages.success(request, f"Deleted “{name}”.")
    return redirect("mcp_server:mcp-token-list")
