"""Admin API for the Terms & Agreement shown to buyers/sellers (V2 §2.2).

Reads require an authenticated staff session; publishing a new version is
content that legally binds users on every future deal, so it's gated the
same as settings/RBAC mutations — superuser only.
"""

from rest_framework import status
from rest_framework.decorators import api_view
from rest_framework.response import Response

from .admin_api import _audit, _operator, _paginate, _require_admin
from .admin_rbac import _require_superuser
from .agreements import publish_agreement
from .models import AgreementTemplate


def _serialize_agreement(a: AgreementTemplate):
    return {
        "id": str(a.id),
        "version": a.version,
        "title": a.title,
        "body": a.body,
        "is_active": a.is_active,
        "effective_from": a.effective_from,
        "effective_to": a.effective_to,
        "created_by": a.created_by,
        "created_at": a.created_at,
        "acceptance_count": a.acceptances.count(),
    }


@api_view(["GET", "POST"])
def admin_agreements(request):
    err = _require_admin(request)
    if err:
        return err

    if request.method == "POST":
        err = _require_superuser(request)
        if err:
            return err
        title = str(request.data.get("title") or "").strip()
        body = str(request.data.get("body") or "").strip()
        if not title or not body:
            return Response({"detail": "title and body are required."}, status=status.HTTP_400_BAD_REQUEST)

        agreement = publish_agreement(title, body, created_by=_operator(request))
        _audit(request, "agreement.publish", agreement, {"version": agreement.version, "title": title})
        return Response(_serialize_agreement(agreement), status=status.HTTP_201_CREATED)

    qs = AgreementTemplate.objects.all().order_by("-version")
    return Response(_paginate(request, qs, _serialize_agreement))