"""Security & compliance endpoints."""

from fastapi import APIRouter, Depends, HTTPException

from ..database import get_session
from ..models import License
from ..security import require_roles
from ..utils import log_action

router = APIRouter()


@router.post("/export")
def export_data(email: str, session=Depends(get_session), _admin=Depends(require_roles("super-admin"))):
    licences = session.query(License).filter(License.email == email).all()
    if not licences:
        raise HTTPException(status_code=404, detail="Client introuvable")
    payload = [
        {
            "api_key": licence.api_key,
            "tier": licence.tier,
            "status": licence.status,
        }
        for licence in licences
    ]
    log_action(session, _admin.email, "compliance_export", target=email)
    session.commit()
    return {"email": email, "licenses": payload}


@router.post("/delete")
def delete_customer(email: str, session=Depends(get_session), _admin=Depends(require_roles("super-admin"))):
    count = session.query(License).filter(License.email == email).delete()
    if count == 0:
        raise HTTPException(status_code=404, detail="Client introuvable")
    log_action(session, _admin.email, "compliance_delete", target=email)
    session.commit()
    return {"deleted": count}