# gateway/src/app.py
import uuid
from datetime import datetime
from contextlib import asynccontextmanager
from typing import Callable

from fastapi import FastAPI, Request, Response
from fastapi.middleware.cors import CORSMiddleware
from fastapi.responses import JSONResponse
from starlette.middleware.base import BaseHTTPMiddleware
from starlette.middleware.trustedhost import TrustedHostMiddleware
import structlog

from gateway.config import settings
from gateway.middleware.auth import auth_middleware
from gateway.middleware.rate_limiter import rate_limiter
from gateway.routes import router as api_router

logger = structlog.get_logger()


@asynccontextmanager
async def lifespan(app: FastAPI):
    # Startup
    logger.info("gateway.starting")
    yield
    # Shutdown
    logger.info("gateway.stopping")


app = FastAPI(lifespan=lifespan)

# Security middleware (trusted hosts = helmet-equivalent host check)
app.add_middleware(
    TrustedHostMiddleware,
    allowed_hosts=settings.allowed_hosts,
)

# CORS
app.add_middleware(
    CORSMiddleware,
    allow_origins=settings.allowed_origins,
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)


class RequestIdMiddleware(BaseHTTPMiddleware):
    """Assign or propagate a correlation ID to every request."""

    async def dispatch(self, request: Request, call_next: Callable) -> Response:
        request_id = request.headers.get("x-request-id") or str(uuid.uuid4())
        request.state.request_id = request_id

        start = datetime.utcnow()
        response = await call_next(request)
        duration_ms = (datetime.utcnow() - start).total_seconds() * 1000

        response.headers["X-Request-ID"] = request_id
        logger.info(
            "http.request",
            method=request.method,
            path=request.url.path,
            status=response.status_code,
            duration_ms=round(duration_ms, 2),
            request_id=request_id,
        )
        return response


app.add_middleware(RequestIdMiddleware)


@app.get("/health")
async def health() -> dict:
    return {"status": "healthy", "timestamp": datetime.utcnow().isoformat()}


# Order matters: rate limit -> auth -> routes
app.middleware("http")(rate_limiter)
app.include_router(api_router, prefix="/api", dependencies=[auth_middleware])


@app.exception_handler(Exception)
async def global_exception_handler(request: Request, exc: Exception) -> JSONResponse:
    request_id = getattr(request.state, "request_id", "unknown")
    logger.error("gateway.error", request_id=request_id, error=str(exc))

    status_code = getattr(exc, "status_code", 500)
    # Only expose message if the exception explicitly opts in (mirrors err.expose)
    message = getattr(exc, "message", None) if getattr(exc, "expose", False) else "Internal server error"

    return JSONResponse(
        status_code=status_code,
        content={
            "error": {
                "code": getattr(exc, "code", "INTERNAL_ERROR"),
                "message": message or "Internal server error",
                "request_id": request_id,
            }
        },
    )

# gateway/src/routes.py
import json
from typing import Optional

import httpx
from fastapi import APIRouter, Request, HTTPException
from fastapi.responses import Response
from pydantic_settings import BaseSettings
import structlog

logger = structlog.get_logger()
router = APIRouter()


class ServiceSettings(BaseSettings):
    user_service_url: str = "http://user-service:3001"
    order_service_url: str = "http://order-service:3002"
    product_service_url: str = "http://product-service:3003"
    payment_service_url: str = "http://payment-service:3004"
    notification_service_url: str = "http://notification-service:3005"

    class Config:
        env_file = ".env"


services = ServiceSettings()

# Shared async client with connection pooling (keep-alive reuse)
_http_client: Optional[httpx.AsyncClient] = None


def get_http_client() -> httpx.AsyncClient:
    global _http_client
    if _http_client is None:
        _http_client = httpx.AsyncClient(
            timeout=httpx.Timeout(30.0, connect=5.0),
            limits=httpx.Limits(max_keepalive_connections=100, max_connections=200),
        )
    return _http_client


def build_forward_headers(request: Request) -> dict:
    """Inject auth + correlation headers for downstream services."""
    headers = {
        "X-Request-ID": getattr(request.state, "request_id", ""),
        "X-Correlation-ID": request.headers.get("x-correlation-id")
                            or getattr(request.state, "request_id", ""),
    }
    user = getattr(request.state, "user", None)
    if user:
        headers["X-User-ID"] = str(user.id)
        headers["X-User-Email"] = user.email
        headers["X-User-Roles"] = json.dumps(user.roles)
    return headers


async def proxy(request: Request, target_base: str, strip_prefix: str) -> Response:
    """Forward an incoming request to a downstream service."""
    client = get_http_client()
    downstream_path = request.url.path.removeprefix(strip_prefix) or "/"
    url = f"{target_base}{downstream_path}"

    try:
        upstream = await client.request(
            method=request.method,
            url=url,
            params=request.query_params,
            content=await request.body(),
            headers=build_forward_headers(request),
        )
    except httpx.RequestError as exc:
        logger.error(
            "gateway.proxy_error",
            request_id=getattr(request.state, "request_id", None),
            target=url,
            error=str(exc),
        )
        raise HTTPException(
            status_code=503,
            detail={
                "code": "SERVICE_UNAVAILABLE",
                "message": "Service temporarily unavailable",
            },
        )

    # Echo response back with security headers
    response_headers = dict(upstream.headers)
    response_headers["X-Content-Type-Options"] = "nosniff"
    response_headers["X-Frame-Options"] = "DENY"

    return Response(
        content=upstream.content,
        status_code=upstream.status_code,
        headers=response_headers,
        media_type=upstream.headers.get("content-type"),
    )


# Route mapping: each path prefix gets stripped before forwarding
@router.api_route("/users/{path:path}", methods=["GET", "POST", "PUT", "PATCH", "DELETE"])
async def users_proxy(request: Request, path: str) -> Response:
    return await proxy(request, services.user_service_url, "/api/users")


@router.api_route("/orders/{path:path}", methods=["GET", "POST", "PUT", "PATCH", "DELETE"])
async def orders_proxy(request: Request, path: str) -> Response:
    return await proxy(request, services.order_service_url, "/api/orders")


@router.api_route("/products/{path:path}", methods=["GET", "POST", "PUT", "PATCH", "DELETE"])
async def products_proxy(request: Request, path: str) -> Response:
    return await proxy(request, services.product_service_url, "/api/products")


@router.api_route("/payments/{path:path}", methods=["GET", "POST", "PUT", "PATCH", "DELETE"])
async def payments_proxy(request: Request, path: str) -> Response:
    return await proxy(request, services.payment_service_url, "/api/payments")


@router.api_route("/notifications/{path:path}", methods=["GET", "POST", "PUT", "PATCH", "DELETE"])
async def notifications_proxy(request: Request, path: str) -> Response:
    return await proxy(request, services.notification_service_url, "/api/notifications")

# gateway/src/middleware/auth.py
import re
from dataclasses import dataclass, field
from typing import Pattern

from fastapi import Request, HTTPException, Depends
from jose import jwt, JWTError, ExpiredSignatureError
from pydantic_settings import BaseSettings


class AuthSettings(BaseSettings):
    jwt_secret: str
    jwt_algorithm: str = "HS256"

    class Config:
        env_file = ".env"


auth_settings = AuthSettings()


@dataclass
class PublicRoute:
    method: str
    path: str | Pattern[str]


PUBLIC_PATHS: list[PublicRoute] = [
    PublicRoute("POST", "/api/users/register"),
    PublicRoute("POST", "/api/users/login"),
    PublicRoute("GET", "/api/products"),
    PublicRoute("GET", re.compile(r"^/api/products/[\w-]+$")),
]


@dataclass
class AuthenticatedUser:
    id: str
    email: str
    roles: list[str] = field(default_factory=list)
    permissions: list[str] = field(default_factory=list)


def _is_public_path(method: str, path: str) -> bool:
    for route in PUBLIC_PATHS:
        method_match = route.method == method or route.method == "*"
        if isinstance(route.path, re.Pattern):
            path_match = bool(route.path.match(path))
        else:
            path_match = route.path == path
        if method_match and path_match:
            return True
    return False


async def auth_dependency(request: Request) -> AuthenticatedUser | None:
    """Validate JWT on protected paths. Returns None for public routes."""
    if _is_public_path(request.method, request.url.path):
        return None

    auth_header = request.headers.get("authorization")
    if not auth_header or not auth_header.startswith("Bearer "):
        raise HTTPException(
            status_code=401,
            detail={"code": "UNAUTHORIZED", "message": "Missing or invalid authorization header"},
        )

    token = auth_header[7:]
    try:
        decoded = jwt.decode(
            token,
            auth_settings.jwt_secret,
            algorithms=[auth_settings.jwt_algorithm],
        )
    except ExpiredSignatureError:
        raise HTTPException(
            status_code=401,
            detail={"code": "TOKEN_EXPIRED", "message": "Authentication token has expired"},
        )
    except JWTError:
        raise HTTPException(
            status_code=401,
            detail={"code": "INVALID_TOKEN", "message": "Invalid authentication token"},
        )

    user = AuthenticatedUser(
        id=decoded["sub"],
        email=decoded.get("email", ""),
        roles=decoded.get("roles", []),
        permissions=decoded.get("permissions", []),
    )
    # Stash on request.state so downstream handlers/proxies can forward it
    request.state.user = user
    return user


# Wire as a dependency on the protected router
auth_middleware = Depends(auth_dependency)


def require_roles(*required_roles: str):
    """Declarative RBAC for individual routes."""
    async def checker(user: AuthenticatedUser | None = Depends(auth_dependency)) -> AuthenticatedUser:
        if user is None:
            raise HTTPException(
                status_code=401,
                detail={"code": "UNAUTHORIZED", "message": "Authentication required"},
            )
        if not any(role in user.roles for role in required_roles):
            raise HTTPException(
                status_code=403,
                detail={"code": "FORBIDDEN", "message": "Insufficient permissions"},
            )
        return user
    return checker

# gateway/src/middleware/rate_limiter.py
from typing import Callable

from fastapi import Request, HTTPException
from slowapi import Limiter
from slowapi.util import get_remote_address
from starlette.responses import JSONResponse
from pydantic_settings import BaseSettings
import redis.asyncio as redis_async


class RateLimitSettings(BaseSettings):
    redis_url: str = "redis://localhost:6379/0"
    internal_secret: str = ""

    class Config:
        env_file = ".env"


rl_settings = RateLimitSettings()

# slowapi uses a sync storage URI; redis-py async client is for custom counters.
limiter = Limiter(
    key_func=get_remote_address,
    storage_uri=rl_settings.redis_url,
    default_limits=["1000/minute"],  # global cap
)

# Separate async client for custom per-endpoint logic
redis_client = redis_async.from_url(rl_settings.redis_url, decode_responses=True)


def _rate_key(request: Request) -> str:
    """Per-user when authenticated, otherwise per-IP."""
    user = getattr(request.state, "user", None)
    if user is not None:
        return f"user:{user.id}"
    return f"ip:{get_remote_address(request)}"


async def rate_limiter(request: Request, call_next: Callable):
    """Top-level middleware that enforces 100 req/min per user (or IP)."""
    # Skip for internal service-to-service calls
    if request.headers.get("x-internal-service") == rl_settings.internal_secret:
        return await call_next(request)

    key = f"ratelimit:{_rate_key(request)}:minute"
    count = await redis_client.incr(key)
    if count == 1:
        await redis_client.expire(key, 60)

    if count > 100:
        return JSONResponse(
            status_code=429,
            content={
                "error": {
                    "code": "RATE_LIMIT_EXCEEDED",
                    "message": "Too many requests, please try again later",
                }
            },
            headers={"Retry-After": "60"},
        )

    response = await call_next(request)
    response.headers["X-RateLimit-Limit"] = "100"
    response.headers["X-RateLimit-Remaining"] = str(max(0, 100 - count))
    return response


async def endpoint_limiter(
    request: Request,
    *,
    max_requests: int,
    window_seconds: int,
    message: str = "Rate limit exceeded for this endpoint",
) -> None:
    """Endpoint-scoped limiter — call from inside specific routes."""
    user_key = _rate_key(request)
    key = f"ratelimit:endpoint:{user_key}:{request.url.path}:{window_seconds}"

    count = await redis_client.incr(key)
    if count == 1:
        await redis_client.expire(key, window_seconds)

    if count > max_requests:
        raise HTTPException(
            status_code=429,
            detail={"code": "ENDPOINT_RATE_LIMIT", "message": message},
        )


# Ready-made helpers for specific routes
async def auth_limiter(request: Request) -> None:
    await endpoint_limiter(
        request,
        max_requests=5,
        window_seconds=15 * 60,
        message="Too many login attempts, please try again later",
    )


async def password_reset_limiter(request: Request) -> None:
    await endpoint_limiter(
        request,
        max_requests=3,
        window_seconds=60 * 60,
        message="Too many password reset requests",
    )

# gateway/src/aggregation/order_details.py
import asyncio
from dataclasses import dataclass
from datetime import datetime
from typing import Any

import httpx
from fastapi import APIRouter, Depends, Request, HTTPException
from pydantic import BaseModel

from gateway.middleware.auth import auth_dependency, AuthenticatedUser
from gateway.routes import services, get_http_client


class AggregationError(Exception):
    pass


@dataclass
class OrderAggregator:
    client: httpx.AsyncClient

    async def _get(self, url: str) -> Any:
        resp = await self.client.get(url)
        resp.raise_for_status()
        return resp.json()

    async def get_order(self, order_id: str) -> dict:
        return await self._get(f"{services.order_service_url}/orders/{order_id}")

    async def get_user(self, user_id: str) -> dict:
        return await self._get(f"{services.user_service_url}/users/{user_id}")

    async def get_order_products(self, order: dict) -> list[dict]:
        product_ids = [item["productId"] for item in order["items"]]
        resp = await self.client.post(
            f"{services.product_service_url}/products/batch",
            json={"ids": product_ids},
        )
        resp.raise_for_status()
        return resp.json()

    async def get_order_timeline(self, order_id: str) -> list[dict]:
        # gather with return_exceptions is the asyncio equivalent of Promise.allSettled
        order_events, shipping_events = await asyncio.gather(
            self._get(f"{services.order_service_url}/orders/{order_id}/events"),
            self._get(f"{services.order_service_url}/shipments/order/{order_id}/events"),
            return_exceptions=True,
        )
        events: list[dict] = []
        if not isinstance(order_events, Exception):
            events.extend(order_events)
        if not isinstance(shipping_events, Exception):
            events.extend(shipping_events)
        return sorted(events, key=lambda e: datetime.fromisoformat(e["timestamp"]))

    async def get_order_details(self, order_id: str, user_id: str) -> dict:
        try:
            order_task = asyncio.create_task(self.get_order(order_id))
            user_task = asyncio.create_task(self.get_user(user_id))
            order = await order_task
            user, products = await asyncio.gather(
                user_task,
                self.get_order_products(order),
            )
        except httpx.HTTPError as exc:
            raise AggregationError("Failed to aggregate order details") from exc

        quantity_by_product = {i["productId"]: i["quantity"] for i in order["items"]}
        return {
            "order": {
                "id": order["id"],
                "status": order["status"],
                "total": order["total"],
                "created_at": order["createdAt"],
            },
            "customer": {"id": user["id"], "name": user["name"], "email": user["email"]},
            "items": [
                {
                    "product_id": p["id"],
                    "name": p["name"],
                    "price": p["price"],
                    "quantity": quantity_by_product.get(p["id"]),
                }
                for p in products
            ],
            "shipping": order.get("shippingAddress"),
            "timeline": await self.get_order_timeline(order_id),
        }

    async def get_dashboard(self, user_id: str) -> dict:
        orders, cart, recommendations, notifications = await asyncio.gather(
            self._get(f"{services.order_service_url}/users/{user_id}/orders?limit=5"),
            self._get(f"{services.order_service_url}/users/{user_id}/cart"),
            self._get(f"{services.product_service_url}/users/{user_id}/recommendations"),
            self._get(f"{services.notification_service_url}/users/{user_id}/unread"),
            return_exceptions=True,
        )

        def ok(v): return v if not isinstance(v, Exception) else None

        return {
            "recent_orders": ok(orders) or [],
            "cart": ok(cart),
            "recommendations": ok(recommendations) or [],
            "unread_notifications": len(ok(notifications) or []),
        }


agg_router = APIRouter()


@agg_router.get("/aggregate/orders/{order_id}")
async def aggregate_order(
    order_id: str,
    user: AuthenticatedUser = Depends(auth_dependency),
) -> dict:
    if user is None:
        raise HTTPException(status_code=401, detail="auth required")
    aggregator = OrderAggregator(get_http_client())
    try:
        return await aggregator.get_order_details(order_id, user.id)
    except AggregationError as exc:
        raise HTTPException(status_code=502, detail=str(exc))


@agg_router.get("/aggregate/dashboard")
async def aggregate_dashboard(
    user: AuthenticatedUser = Depends(auth_dependency),
) -> dict:
    if user is None:
        raise HTTPException(status_code=401, detail="auth required")
    aggregator = OrderAggregator(get_http_client())
    return await aggregator.get_dashboard(user.id)

# mobile_bff/routes/products.py
import asyncio

from fastapi import APIRouter, Request

from mobile_bff.clients import product_service, review_service

router = APIRouter(prefix="/products")


@router.get("")
async def list_products(request: Request) -> dict:
    """Slim product list for mobile — single thumbnail, minimal fields."""
    products = await product_service.get_products(dict(request.query_params))
    return {
        "products": [
            {
                "id": p["id"],
                "name": p["name"],
                "price": p["price"],
                "thumbnail": p["images"][0]["thumbnail"] if p.get("images") else None,
                "rating": p.get("averageRating"),
                "in_stock": p["stockQuantity"] > 0,
            }
            for p in products["items"]
        ],
        "pagination": products["pagination"],
    }


@router.get("/{product_id}")
async def get_product(product_id: str) -> dict:
    """Mobile product detail — short description, 5 images max, top-3 reviews."""
    product, reviews = await asyncio.gather(
        product_service.get_product(product_id),
        review_service.get_top_reviews(product_id, limit=3),
    )

    return {
        "id": product["id"],
        "name": product["name"],
        "price": product["price"],
        "description": product["shortDescription"],
        "images": product["images"][:5],
        "rating": product.get("averageRating"),
        "review_count": product.get("reviewCount", 0),
        "top_reviews": reviews,
        "in_stock": product["stockQuantity"] > 0,
        "variants": [
            {
                "id": v["id"],
                "name": v["name"],
                "price": v["price"],
                "in_stock": v["stockQuantity"] > 0,
            }
            for v in product.get("variants", [])
        ],
    }

# web_bff/routes/products.py
import asyncio
import time

from fastapi import APIRouter, Request

from web_bff.clients import product_service, review_service, category_service, question_service

router = APIRouter(prefix="/products")


@router.get("")
async def list_products(request: Request) -> dict:
    """Rich product list for web — includes categories, filters, and meta in one response."""
    started = time.time()
    query = dict(request.query_params)

    products, categories, filters = await asyncio.gather(
        product_service.get_products(query),
        category_service.get_categories(),
        product_service.get_available_filters(query),
    )

    return {
        "products": [
            {
                "id": p["id"],
                "name": p["name"],
                "description": p.get("shortDescription"),
                "price": p["price"],
                "original_price": p.get("originalPrice"),
                "discount": p.get("discount"),
                "images": p.get("images", []),
                "rating": p.get("averageRating"),
                "review_count": p.get("reviewCount", 0),
                "in_stock": p["stockQuantity"] > 0,
                "badges": p.get("badges", []),
                "categories": p.get("categories", []),
            }
            for p in products["items"]
        ],
        "pagination": products["pagination"],
        "categories": categories,
        "filters": filters,
        "meta": {
            "total_products": products.get("total"),
            "execution_ms": round((time.time() - started) * 1000, 2),
        },
    }


@router.get("/{product_id}")
async def get_product(product_id: str) -> dict:
    """Web product detail page — full product + reviews + related + Q&A + breadcrumbs."""
    product, reviews, related, questions = await asyncio.gather(
        product_service.get_product(product_id),
        review_service.get_reviews(product_id, limit=10),
        product_service.get_related_products(product_id, limit=8),
        question_service.get_questions(product_id, limit=5),
    )

    breadcrumbs = await category_service.get_breadcrumbs(product["categoryId"])

    return {
        "product": {
            **product,
            "specifications": product.get("specifications"),
            "full_description": product.get("fullDescription"),
        },
        "reviews": {
            "items": reviews["items"],
            "summary": reviews["summary"],
            "pagination": reviews["pagination"],
        },
        "related_products": related,
        "questions": questions,
        "breadcrumbs": breadcrumbs,
    }