"""Risk item submission and review endpoints."""

from typing import Annotated

from fastapi import APIRouter, Depends, Query

from app.api.dependencies import DatabaseSession, require_permission
from app.models.entities import UserAccount
from app.schemas.common import ApiResponse
from app.schemas.risk_item import ReviewActionRequest, ReviewRecordData, RiskItemCreate, RiskItemData, RiskItemUpdate
from app.services.risk_items import RiskItemService

router = APIRouter(prefix="/risk-items", tags=["risk-items"])


@router.post("", response_model=ApiResponse[RiskItemData])
async def create_risk_item(
    payload: RiskItemCreate,
    session: DatabaseSession,
    current_user: Annotated[UserAccount, Depends(require_permission("risk_item.submit", operate=True))],
) -> ApiResponse[RiskItemData]:
    return ApiResponse(data=await RiskItemService(session).submit(payload, current_user))


@router.get("/pending", response_model=ApiResponse[list[RiskItemData]])
async def pending_risk_items(
    session: DatabaseSession,
    _current_user: Annotated[UserAccount, Depends(require_permission("risk_item.review"))],
    limit: int = Query(100, ge=1, le=100),
    source_type: str = Query("all"),
    status: str = Query("待审核"),
) -> ApiResponse[list[RiskItemData]]:
    return ApiResponse(
        data=await RiskItemService(session).list_pending(
            limit,
            source_type=source_type,
            status=status,
        )
    )


@router.patch("/{item_id}", response_model=ApiResponse[RiskItemData])
async def update_risk_item(
    item_id: int,
    payload: RiskItemUpdate,
    session: DatabaseSession,
    current_user: Annotated[UserAccount, Depends(require_permission("risk_item.review", operate=True))],
) -> ApiResponse[RiskItemData]:
    return ApiResponse(data=await RiskItemService(session).update(item_id, payload, current_user))


@router.post("/{item_id}/review", response_model=ApiResponse[ReviewRecordData])
async def review_risk_item(
    item_id: int,
    payload: ReviewActionRequest,
    session: DatabaseSession,
    current_user: Annotated[UserAccount, Depends(require_permission("risk_item.review", operate=True))],
) -> ApiResponse[ReviewRecordData]:
    return ApiResponse(data=await RiskItemService(session).review(item_id, payload.action, payload.note, current_user))