from flask import Blueprint, render_template, request, redirect, url_for, session, abort
from functools import wraps
import database

auth_bp = Blueprint('auth', __name__)

# --- 權限檢查裝飾器 ---
def login_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if 'user_id' not in session:
            return redirect(url_for('auth.login'))
        return f(*args, **kwargs)
    return decorated_function

def admin_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if session.get('role') != 'admin':
            abort(403)
        return f(*args, **kwargs)
    return decorated_function

@auth_bp.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form.get('username')
        password = request.form.get('password')
        user = database.verify_user(username, password)
        if user:
            session['user_id'] = user['user_id']
            session['username'] = user['username']
            session['name'] = user['name']
            session['role'] = user['role']
            return redirect('./')
        return "帳號或密碼錯誤"
    return render_template('login.html')

@auth_bp.route('/logout')
def logout():
    session.clear()
    return redirect('login')

@auth_bp.route('/register', methods=['GET', 'POST'])
@login_required
@admin_required
def register():
    error = None
    if request.method == 'POST':
        username = request.form.get('username', '').strip()
        name = request.form.get('name', '').strip()
        password = request.form.get('password')
        confirm_password = request.form.get('confirm_password')
        role = request.form.get('role')
        if password != confirm_password:
            error = "兩次輸入的密碼不一致"
        else:
            res, msg = database.create_user(username, password, name, role)
            if res: return redirect('/mmwave/login')
            error = msg
    return render_template('register.html', error=error, user_name=session.get('name'), user_role=session.get('role'))