"""器谱 API：设备配对/撤销、逐项授契/撤回、可用性裁决。"""

from fastapi import APIRouter, Depends
from pydantic import BaseModel, Field

from app.api.v1.deps import get_current_user
from app.domains.tianzai import service
from app.schemas.auth import CurrentUser

device_router = APIRouter(prefix="/devices", tags=["tianzai"])


class PairRequest(BaseModel):
    kind: str = "desktop_shell"
    name: str = Field(default="", max_length=120)
    key_fingerprint: str = Field(min_length=8, max_length=128)


class GrantRequest(BaseModel):
    capability: str
    scope: dict = Field(default_factory=dict)


@device_router.post("", status_code=201)
async def pair_device_api(payload: PairRequest, user: CurrentUser = Depends(get_current_user)) -> dict:
    return await service.pair_device(
        owner_scope=user.owner_scope, kind=payload.kind,
        name=payload.name, key_fingerprint=payload.key_fingerprint,
    )


@device_router.get("")
async def list_devices_api(user: CurrentUser = Depends(get_current_user)) -> list[dict]:
    return await service.list_devices(user.owner_scope)


@device_router.post("/{device_id}/revoke")
async def revoke_device_api(device_id: str, user: CurrentUser = Depends(get_current_user)) -> dict:
    return await service.revoke_device(device_id, user.owner_scope)


@device_router.post("/{device_id}/grants", status_code=201)
async def grant_api(
    device_id: str, payload: GrantRequest, user: CurrentUser = Depends(get_current_user)
) -> dict:
    return await service.grant(
        device_id, user.owner_scope, capability=payload.capability, scope=payload.scope
    )


@device_router.get("/{device_id}/grants")
async def list_grants_api(device_id: str, user: CurrentUser = Depends(get_current_user)) -> list[dict]:
    return await service.list_grants(device_id, user.owner_scope)


@device_router.post("/{device_id}/assert/{capability}")
async def assert_grant_api(
    device_id: str, capability: str, user: CurrentUser = Depends(get_current_user)
) -> dict:
    """能力使用前置裁决（未授契 403）。"""
    return await service.assert_granted(device_id, user.owner_scope, capability)


@device_router.post("/grants/{grant_id}/revoke")
async def revoke_grant_api(grant_id: str, user: CurrentUser = Depends(get_current_user)) -> dict:
    return await service.revoke_grant(grant_id, user.owner_scope)