"""
Authentication blueprint - login, signup, logout routes.
"""
from flask import Blueprint, render_template, redirect, url_for, flash, request
from flask_login import login_user, logout_user, login_required, current_user
from app.models import db, User
from app.forms import LoginForm, SignupForm

# Import bcrypt from app package (already initialized in __init__.py)
from app import bcrypt


auth_bp = Blueprint('auth', __name__)


@auth_bp.route('/login', methods=['GET', 'POST'])
def login():
    """User login."""
    if current_user.is_authenticated:
        return redirect(url_for('main.home'))

    form = LoginForm()
    if form.validate_on_submit():
        user = User.query.filter_by(email=form.email.data).first()
        
        if user and bcrypt.check_password_hash(user.password_hash, form.password.data):
            login_user(user)
            flash('Login successful!', 'success')
            next_page = request.args.get('next')
            # Validate next_page to prevent open redirect attacks
            if next_page and next_page.startswith('/'):
                return redirect(next_page)
            return redirect(url_for('main.home'))
        
        flash('Invalid email or password.', 'error')
    
    return render_template('signin.html', form=form)


@auth_bp.route('/signin', methods=['GET', 'POST'])
def signin():
    """Alias for login route."""
    return login()


@auth_bp.route('/signup', methods=['GET', 'POST'])
def signup():
    """User registration."""
    if current_user.is_authenticated:
        return redirect(url_for('main.home'))

    form = SignupForm()
    if form.validate_on_submit():
        # Check if email already exists before trying to insert
        existing_user = User.query.filter_by(email=form.email.data).first()
        if existing_user:
            flash('This email is already registered. Please use a different email or log in.', 'error')
            return render_template('signup.html', form=form)
        
        password_hash = bcrypt.generate_password_hash(form.password.data).decode('utf-8')
        new_user = User(
            full_name=form.full_name.data,
            email=form.email.data,
            password_hash=password_hash
        )
        
        try:
            db.session.add(new_user)
            db.session.commit()
            flash('Signup successful! Please log in.', 'success')
            return redirect(url_for('auth.signin'))
        except Exception as e:
            db.session.rollback()
            flash('An error occurred during sign up. Please try again.', 'error')
    
    return render_template('signup.html', form=form)


@auth_bp.route('/logout')
@login_required
def logout():
    """User logout."""
    logout_user()
    flash('You have been logged out.', 'success')
    return redirect(url_for('main.home'))