PacketStation/server/packetstation/api/admin_org.py

"""Admin: departments and stations, people's profiles (one at a time and the CSV import), checklist templates.

Every route needs the admin role and a password session. Every change is audited (`admin.*`).
"""

from __future__ import annotations

import re
import uuid
from typing import Any

from fastapi import APIRouter, Depends, Request
from fastapi.encoders import jsonable_encoder
from psycopg.types.json import Jsonb
from pydantic import BaseModel, ConfigDict, Field

from .. import audit
from ..auth import groups as groupmap
from ..domain import checklists, profiles
from ..domain import departments as depts
from .admin import groups_in_ou
from .deps import Db, Principal, admin_principal, get_db
from .errors import ApiError
from .packets import WRITE

router = APIRouter(prefix="/api/admin", tags=["admin"])

IMPORT_MAX_BODY = profiles.CSV_MAX_BYTES * 2 + 10_000  # JSON escaping can double the text


def import_limit(request: Request) -> None:
    length = request.headers.get("content-length")
    if length is not None and length.strip().isdigit() and int(length) > IMPORT_MAX_BODY:
        raise ApiError(413, "too_large", "The file is larger than 1 MB.")


def reload_groups(request: Request, conn: Any) -> None:
    """Rebuild the group map from the departments table and drop the cached OU listing."""
    found = groupmap.load_departments(conn)
    if found:
        groupmap.use_departments(found)
    request.app.state.groups_cache = None


# ---------------------------------------------------------------- departments


class StationIn(BaseModel):
    model_config = ConfigDict(extra="forbid")

    id: int | None = None
    name: str = Field(max_length=200)
    sort: int = Field(0, ge=0, le=100_000)
    active: bool = True


class DepartmentPatch(BaseModel):
    model_config = ConfigDict(extra="forbid")

    name: str | None = Field(None, max_length=200)
    active: bool | None = None
    stations: list[StationIn] | None = Field(None, max_length=depts.STATIONS_MAX)


class DepartmentNew(BaseModel):
    model_config = ConfigDict(extra="forbid")

    code: str = Field(max_length=10)
    slug: str = Field(max_length=40)
    name: str = Field(max_length=200)
    kind: str = Field(pattern="^(shop|support)$")
    weld: bool = False
    supervisor_group: bool = True
    stations: list[str] = Field(default_factory=list, max_length=depts.STATIONS_MAX)


@router.get("/departments")
def department_list(
    request: Request,
    p: Principal = Depends(admin_principal),  # noqa: B008
    d: Db = Depends(get_db),  # noqa: B008
) -> list[dict[str, Any]]:
    return depts.list_all(d.conn, groups_in_ou(request))


@router.patch("/departments/{code}", dependencies=WRITE)
def department_update(
    code: str,
    body: DepartmentPatch,
    request: Request,
    p: Principal = Depends(admin_principal),  # noqa: B008
    d: Db = Depends(get_db),  # noqa: B008
) -> dict[str, Any]:
    conn = d.conn
    depts.update(
        conn,
        p,
        code[:10],
        name=body.name,
        active=body.active,
        stations=[s.model_dump() for s in body.stations] if body.stations is not None else None,
    )
    reload_groups(request, conn)
    out = depts.get(conn, code[:10], groups_in_ou(request))
    assert out is not None
    return out


@router.post("/departments", status_code=201, dependencies=WRITE)
def department_add(
    body: DepartmentNew,
    request: Request,
    p: Principal = Depends(admin_principal),  # noqa: B008
    d: Db = Depends(get_db),  # noqa: B008
) -> dict[str, Any]:
    conn = d.conn
    _, groups = depts.add(
        conn,
        p,
        code=body.code,
        slug=body.slug,
        name=body.name,
        kind=body.kind,
        weld=body.weld,
        supervisor_group=body.supervisor_group,
        stations=body.stations,
    )
    reload_groups(request, conn)
    dept = depts.get(conn, body.code.strip(), groups_in_ou(request))
    return {"department": dept, "groups_to_create": groups}


# ---------------------------------------------------------------- profiles


class ProfilePatch(BaseModel):
    model_config = ConfigDict(extra="forbid")

    welder_stamp: str | None = Field(None, max_length=40)
    profile_active: bool | None = None
    station_limits: dict[str, list[int]] | None = None


class ImportBody(BaseModel):
    model_config = ConfigDict(extra="forbid")

    csv: str
    apply: bool = False


@router.patch("/users/{user_id}/profile", dependencies=WRITE)
def profile_update(
    user_id: uuid.UUID,
    body: ProfilePatch,
    p: Principal = Depends(admin_principal),  # noqa: B008
    d: Db = Depends(get_db),  # noqa: B008
) -> dict[str, Any]:
    fields = body.model_dump(exclude_unset=True)
    out = profiles.update(d.conn, p, user_id, fields)
    return {"user_id": str(user_id), **out}


@router.post("/users/import", dependencies=[Depends(import_limit)])
def profile_import(
    body: ImportBody,
    p: Principal = Depends(admin_principal),  # noqa: B008
    d: Db = Depends(get_db),  # noqa: B008
) -> dict[str, Any]:
    return profiles.import_profiles(d.conn, p, body.csv, apply=body.apply)


# ---------------------------------------------------------------- checklists

RX_BRACES = re.compile(r"\{[^{}]*\}")
ALLOWED_PLACEHOLDERS = ("{drawing}", "{rev}", "{wps}")


class ChecklistsPut(BaseModel):
    model_config = ConfigDict(extra="forbid")

    value: dict[str, Any]
    version: int = Field(ge=0)


def check_templates(value: Any) -> tuple[dict[str, list[dict[str, str]]], list[str]]:
    """The checklist templates cleaned, and one error line per problem."""
    errors: list[str] = []
    out: dict[str, list[dict[str, str]]] = {}
    if not isinstance(value, dict):
        return {}, ["value must be an object with weld and plain lists"]
    extra = sorted(k for k in value if k not in ("weld", "plain"))
    if extra:
        errors.append(f"unknown list: {', '.join(extra)}")
    for name in ("weld", "plain"):
        items = value.get(name)
        if not isinstance(items, list) or not items:
            errors.append(f"{name}: at least one item")
            continue
        if len(items) > checklists.ITEMS_MAX:
            errors.append(f"{name}: at most {checklists.ITEMS_MAX} items")
        seen: set[str] = set()
        clean: list[dict[str, str]] = []
        for i, it in enumerate(items, start=1):
            where = f"{name} item {i}"
            if not isinstance(it, dict):
                errors.append(f"{where}: must be an object with group, key and text")
                continue
            group = " ".join(str(it.get("group") or "").split())
            key = str(it.get("key") or "").strip()
            text = " ".join(str(it.get("text") or "").split())
            if not checklists.RX_KEY.match(key):
                errors.append(f"{where}: the key is a lower-case letter, then letters, digits or _ (at most 30)")
            elif key in seen:
                errors.append(f"{where}: key {key} is used twice")
            seen.add(key)
            if not group:
                errors.append(f"{where}: the group is empty")
            if not text:
                errors.append(f"{where}: the text is empty")
            if len(group) > checklists.TEXT_MAX or len(text) > checklists.TEXT_MAX:
                errors.append(f"{where}: at most {checklists.TEXT_MAX} characters")
            bad = [m for m in RX_BRACES.findall(text) if m not in ALLOWED_PLACEHOLDERS]
            stray = RX_BRACES.sub("", text)
            if bad:
                errors.append(f"{where}: unknown placeholder {', '.join(bad)} (use {{drawing}}, {{rev}} or {{wps}})")
            elif "{" in stray or "}" in stray:
                errors.append(f"{where}: a brace without its pair")
            clean.append({"group": group, "key": key, "text": text})
        out[name] = clean
    return out, errors


def _checklists_out(conn: Any) -> dict[str, Any]:
    row = conn.execute("SELECT version FROM settings WHERE key = %s", (checklists.SETTINGS_KEY,)).fetchone()
    return {
        "value": checklists.load_templates(conn),
        "defaults": checklists.DEFAULT_TEMPLATES,
        "version": int(row[0]) if row else 0,
    }


@router.get("/checklists")
def checklists_get(p: Principal = Depends(admin_principal), d: Db = Depends(get_db)) -> dict[str, Any]:  # noqa: B008
    return _checklists_out(d.conn)


@router.put("/checklists", dependencies=WRITE)
def checklists_put(
    body: ChecklistsPut,
    p: Principal = Depends(admin_principal),  # noqa: B008
    d: Db = Depends(get_db),  # noqa: B008
) -> dict[str, Any]:
    conn = d.conn
    value, errors = check_templates(body.value)
    if errors:
        raise ApiError(422, "bad_checklists", errors[0], extra={"errors": errors})
    with conn.transaction():
        row = conn.execute(
            "SELECT version FROM settings WHERE key = %s FOR UPDATE", (checklists.SETTINGS_KEY,)
        ).fetchone()
        current = int(row[0]) if row else 0
        if body.version != current:
            raise ApiError(
                409,
                "version_conflict",
                "Someone else changed the checklists. Reload and try again.",
                extra={"current": jsonable_encoder(_checklists_out(conn))},
            )
        before = checklists.load_templates(conn)
        conn.execute(
            "INSERT INTO settings (key, value, version, updated_at, updated_by) VALUES (%s, %s, 1, now(), %s)"
            " ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, version = settings.version + 1,"
            " updated_at = now(), updated_by = EXCLUDED.updated_by",
            (checklists.SETTINGS_KEY, Jsonb(value), p.user_id),
        )
        audit.append(
            conn,
            action="admin.checklists_updated",
            user_id=p.user_id,
            session_id=p.session_id,
            role_snapshot=p.role_snapshot,
            subject_type="settings",
            subject_id=checklists.SETTINGS_KEY,
            detail={"before": before, "after": value},
            ip=p.ip,
        )
    return _checklists_out(conn)