import hashlib

from core.utils import get_client_ip

from .models import AuthEventLog


def compute_device_fingerprint(request):
    """Prefer a client-sent fingerprint; otherwise derive a stable server-side one
    from User-Agent + IP + Accept-Language (SHA-256, truncated to 32 hex chars)."""
    client_fp = request.headers.get("X-Device-Fingerprint", "").strip()
    if client_fp:
        return client_fp[:64]
    raw = "|".join([
        request.headers.get("User-Agent", ""),
        get_client_ip(request) or "",
        request.headers.get("Accept-Language", ""),
    ])
    return hashlib.sha256(raw.encode("utf-8", "ignore")).hexdigest()[:32]


def log_auth_event(user, event_type, request=None, ip_address=None, user_agent=None, device_fingerprint=None):
    """Persist an auth event. Pass either the request or explicit ip/user_agent."""
    if request is not None:
        ip_address = ip_address or get_client_ip(request)
        user_agent = user_agent or request.headers.get("User-Agent", "")
        device_fingerprint = device_fingerprint or compute_device_fingerprint(request)

    AuthEventLog.objects.create(
        user=user,
        event_type=event_type,
        ip_address=ip_address,
        user_agent=user_agent,
        device_fingerprint=device_fingerprint,
    )


def log_activity(user, action, description, request=None, ip_address=None):
    """Log generic system activity, and post to Gateway for real-time broadcast."""
    from .models import AuditLog
    from core.utils import get_client_ip
    import httpx
    from django.conf import settings
    import logging
    
    logger = logging.getLogger(__name__)

    if request is not None:
        ip_address = ip_address or get_client_ip(request)

    # Save to db
    log_entry = AuditLog.objects.create(
        user=user,
        action=action,
        description=description,
        ip_address=ip_address,
    )

    # Post to Gateway for real-time broadcast
    try:
        # FastAPI gateway is at port 8000
        gateway_url = getattr(settings, "GATEWAY_URL", "http://localhost:8000")
        broadcast_endpoint = f"{gateway_url}/api/v1/gateway/broadcast"
        headers = {
            "Authorization": f"Bearer {settings.INTERNAL_API_SECRET}"
        }
        
        # Format user name cleanly
        user_name = "System"
        user_email = "system"
        if user:
            user_email = user.email
            if user.full_name:
                user_name = user.full_name
            else:
                user_name = user.email.split("@")[0].capitalize()

        payload = {
            "id": log_entry.id,
            "user_email": user_email,
            "user_name": user_name,
            "action": action,
            "description": description,
            "ip_address": ip_address or "127.0.0.1",
            "created_at": log_entry.created_at.isoformat()
        }
        httpx.post(broadcast_endpoint, json=payload, headers=headers, timeout=1.0)
    except Exception as e:
        logger.error(f"Failed to broadcast activity log to gateway: {e}")

    return log_entry