"""Issue a one-time password-reset capability from a trusted operator shell."""

import argparse
import asyncio
import sys
import uuid
from datetime import UTC, datetime, timedelta
from pathlib import Path

sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "services" / "core-api"))

from app.audit import compute_audit_hash
from app.config import get_settings
from app.database import session_factory
from app.models import (
    AuditEvent,
    PasswordResetToken,
    User,
    Workspace,
    WorkspaceMembership,
)
from app.security import generate_token, hash_token
from sqlalchemy import select, update


def parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(
        description=(
            "Create a short-lived, one-time password-reset capability. Run only from a trusted "
            "operator shell and transmit the result over an authenticated out-of-band channel."
        )
    )
    parser.add_argument("--email", required=True)
    parser.add_argument("--workspace-id", type=uuid.UUID)
    return parser.parse_args()


async def issue(email: str, workspace_id: uuid.UUID | None) -> str:
    normalized_email = email.strip().lower()
    settings = get_settings()
    now = datetime.now(UTC)
    async with session_factory() as session:
        user = await session.scalar(
            select(User).where(User.email == normalized_email, User.is_active.is_(True))
        )
        if not user:
            raise RuntimeError("No active user matches that identity")
        memberships = list((await session.scalars(select(WorkspaceMembership).where(
            WorkspaceMembership.user_id == user.id,
            WorkspaceMembership.status == "active",
        ))).all())
        if workspace_id:
            membership = next(
                (item for item in memberships if item.workspace_id == workspace_id), None
            )
        elif len(memberships) == 1:
            membership = memberships[0]
        else:
            membership = None
        if not membership:
            raise RuntimeError("Specify one active --workspace-id for this user")
        workspace = await session.scalar(select(Workspace).where(
            Workspace.id == membership.workspace_id
        ).with_for_update())
        if not workspace:
            raise RuntimeError("The selected workspace is unavailable")
        await session.execute(update(PasswordResetToken).where(
            PasswordResetToken.user_id == user.id,
            PasswordResetToken.used_at.is_(None),
        ).values(used_at=now))
        raw_token = generate_token()
        token = PasswordResetToken(
            id=uuid.uuid4(), workspace_id=workspace.id, user_id=user.id,
            token_hash=hash_token(raw_token),
            expires_at=now + timedelta(minutes=settings.password_reset_minutes),
        )
        session.add(token)
        sequence = workspace.audit_sequence + 1
        event_id = uuid.uuid4()
        request_id = f"operator-password-reset-{token.id}"
        data = {"reset_token_id": str(token.id), "expires_at": token.expires_at.isoformat()}
        event_hash = compute_audit_hash(
            previous_hash=workspace.audit_head_hash, sequence=sequence, event_id=event_id,
            workspace_id=workspace.id, actor_id=user.id,
            event_type="auth.password_reset_issued", request_id=request_id, data=data,
        )
        session.add(AuditEvent(
            id=event_id, workspace_id=workspace.id, sequence=sequence,
            event_type="auth.password_reset_issued", actor_type="operator", actor_id=user.id,
            request_id=request_id, data=data, previous_hash=workspace.audit_head_hash,
            event_hash=event_hash,
        ))
        workspace.audit_sequence = sequence
        workspace.audit_head_hash = event_hash
        await session.commit()
        return raw_token


async def main() -> None:
    args = parse_args()
    token = await issue(args.email, args.workspace_id)
    print(token)


if __name__ == "__main__":
    asyncio.run(main())