from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_login import LoginManager
from flask_migrate import Migrate
from flask_mail import Mail
from flask_wtf.csrf import CSRFProtect
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
from config import config
import os
import logging
from logging.handlers import RotatingFileHandler

db            = SQLAlchemy()
login_manager = LoginManager()
migrate       = Migrate()
mail          = Mail()
csrf          = CSRFProtect()    # initialized here; .init_app() called in create_app()
limiter       = Limiter(
    key_func       = get_remote_address,
    default_limits = [],          # no global limit — applied per-route only
    # Use Redis when REDIS_URL is set in the environment (production multi-worker).
    # Falls back to in-process memory for local development (single-worker only;
    # counters are NOT shared across Gunicorn workers in memory:// mode).
    storage_uri    = os.environ.get('REDIS_URL', 'memory://'),
)


def create_app(config_name='default'):
    app = Flask(__name__)
    app.config.from_object(config[config_name])

    db.init_app(app)
    login_manager.init_app(app)
    migrate.init_app(app, db)
    mail.init_app(app)
    csrf.init_app(app)    # enables CSRF protection for all web routes
    limiter.init_app(app) # rate limiting — applied per-route via @limiter.limit()

    login_manager.login_view         = 'auth.login'
    login_manager.login_message      = 'Please log in to access this page.'
    login_manager.login_message_category = 'info'

    # ── Logging setup ────────────────────────────────────────────────────────
    # Configure root logger so that logger.info/error calls in all modules
    # (notifications.py, issues.py, etc.) actually write output.
    # Writes to stdout (captured by journalctl/gunicorn) AND a rotating file.
    if not app.debug or os.environ.get('LOG_TO_FILE'):
        log_level = logging.INFO

        formatter = logging.Formatter(
            '[%(asctime)s] %(levelname)s in %(module)s: %(message)s',
            datefmt='%Y-%m-%d %H:%M:%S',
        )

        # Stream handler — always on; journalctl captures stdout
        stream_handler = logging.StreamHandler()
        stream_handler.setLevel(log_level)
        stream_handler.setFormatter(formatter)

        # Rotating file handler — keeps 5 × 5 MB log files
        log_dir  = os.path.join(os.path.dirname(os.path.dirname(__file__)), 'logs')
        os.makedirs(log_dir, exist_ok=True)
        file_handler = RotatingFileHandler(
            os.path.join(log_dir, 'jqc.log'),
            maxBytes=5 * 1024 * 1024,
            backupCount=5,
        )
        file_handler.setLevel(log_level)
        file_handler.setFormatter(formatter)

        # Apply to both the Flask app logger and the root logger so all
        # getLogger(__name__) calls in sub-modules are captured.
        app.logger.setLevel(log_level)
        app.logger.addHandler(stream_handler)
        app.logger.addHandler(file_handler)

        root_logger = logging.getLogger()
        root_logger.setLevel(log_level)
        if not root_logger.handlers:
            root_logger.addHandler(stream_handler)
            root_logger.addHandler(file_handler)

    # Register csrf_token() as an app-wide Jinja2 global so templates that
    # render manual forms (no WTForms object) can still inject the CSRF token.
    # CSRFProtect (initialized above) is the authoritative guard for web routes;
    # the /api/v1 blueprint is exempted below via csrf.exempt().
    from flask_wtf.csrf import generate_csrf
    app.jinja_env.globals['csrf_token'] = generate_csrf
    app.jinja_env.globals['enumerate']  = enumerate

    # SLA helpers available in all templates
    from app.utils.sla import sla_status, sla_deadline, sla_hours_remaining, SLA_HOURS
    app.jinja_env.globals['sla_status']          = sla_status
    app.jinja_env.globals['sla_deadline']        = sla_deadline
    app.jinja_env.globals['sla_hours_remaining'] = sla_hours_remaining
    app.jinja_env.globals['SLA_HOURS']           = SLA_HOURS

    # ── Inject unread notification count into every template context ──────
    # This powers the red badge on the navbar bell icon without requiring
    # individual routes to pass the count manually.
    from flask_login import current_user

    @app.context_processor
    def inject_notification_count():
        try:
            if current_user.is_authenticated:
                from app.models.notification import Notification
                from app.models.issue import Issue
                unread = Notification.query.filter_by(
                    user_id=current_user.id, is_read=False
                ).count()
                # Pending verification count — only computed for director+ roles
                pv_count = 0
                if current_user.role in ('admin', 'director'):
                    pv_count = Issue.query.filter_by(
                        status='pending_verification'
                    ).count()
                return {
                    'unread_notification_count':   unread,
                    'pending_verification_count':  pv_count,
                }
        except Exception:
            pass
        return {'unread_notification_count': 0, 'pending_verification_count': 0}

    os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)

    from app.routes import auth, dashboard, inspections, templates, reports, facilities
    from app.routes import issues          # Phase 3
    from app.routes import notifications   # Notification system
    from app.routes import audit           # Audit Trail
    from app.routes import projects        # Phase 1/2 — Project management
    from app.routes import customers       # Phase 5 — Customer management
    from app.routes import scheduled_reports  # Phase 6 — Scheduled reports

    app.register_blueprint(auth.bp)
    app.register_blueprint(dashboard.bp)
    app.register_blueprint(inspections.bp)
    app.register_blueprint(templates.bp)
    app.register_blueprint(reports.bp)
    app.register_blueprint(facilities.bp)
    app.register_blueprint(issues.bp)
    app.register_blueprint(notifications.bp)
    app.register_blueprint(audit.bp)
    app.register_blueprint(projects.bp)
    app.register_blueprint(customers.bp)
    app.register_blueprint(scheduled_reports.bp)

    # ── Mobile API (Phase 7) ─────────────────────────────────────────────────
    # The /api/v1 blueprint uses JWT Bearer tokens — no CSRF cookies needed.
    # Exempt it from CSRFProtect before registering so POST /api/v1/* routes
    # are never rejected for a missing CSRF token.
    from app.api import register_api, api_bp
    csrf.exempt(api_bp)
    register_api(app)

    # ── Error handler: 413 Request Entity Too Large ───────────────────────
    # Nginx can return 413 before Flask sees the request; this handler covers
    # the Flask-side rejection and gives users a clear, actionable message
    # with a redirect back into the inspection workflow.
    from werkzeug.exceptions import RequestEntityTooLarge

    @app.errorhandler(RequestEntityTooLarge)
    @app.errorhandler(413)
    def handle_413(e):
        from flask import request as flask_request, flash as flask_flash, redirect, url_for
        flask_flash(
            f'The uploaded file(s) are too large. '
            f'Please reduce the photo size or upload fewer photos at once '
            f'(maximum {app.config["MAX_CONTENT_LENGTH"] // (1024 * 1024)}MB per submission).',
            'danger'
        )
        # Redirect back to the referring page if available, otherwise dashboard
        referrer = flask_request.referrer
        return redirect(referrer or url_for('dashboard.index')), 302

    return app