"""Shared image upload router — admin-only, reused across all forms."""

import os
import uuid

from fastapi import APIRouter, Depends, HTTPException, UploadFile, status

from app.auth import get_current_admin_user
from app.user_models import User

router = APIRouter()

UPLOAD_DIR = os.path.join(
    os.path.dirname(os.path.dirname(os.path.dirname(__file__))), "uploads",
)
MAX_FILE_SIZE = 5 * 1024 * 1024  # 5 MB


@router.post("/image")
async def upload_image(
    file: UploadFile,
    current_user: User = Depends(get_current_admin_user),
):
    """Upload an image file. Admin only.

    Saves the file to the uploads/ directory with a UUID filename.
    Returns the relative URL path.
    """
    # Validate MIME type
    if not file.content_type or not file.content_type.startswith("image/"):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Only image files are allowed",
        )

    # Read and validate size
    content = await file.read()
    if len(content) > MAX_FILE_SIZE:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="File size exceeds 5 MB limit",
        )

    # Ensure upload directory exists
    os.makedirs(UPLOAD_DIR, exist_ok=True)

    # Generate unique filename preserving extension
    ext = (
        os.path.splitext(file.filename or "upload")[1]
        if file.filename
        else ".bin"
    )
    filename = f"{uuid.uuid4().hex}{ext}"
    filepath = os.path.join(UPLOAD_DIR, filename)

    with open(filepath, "wb") as f:
        f.write(content)

    return {"url": f"uploads/{filename}"}