# routes/feedback_employee.py

from flask import Blueprint, render_template, request, redirect, url_for, flash
from flask_login import login_required, current_user
from datetime import datetime
from urllib.parse import urlparse
from extensions import db
from models import FeedbackQuestion, FeedbackResponse, FeedbackAnswer, FeedbackAnswerOption, FeedbackOption

feedback_emp_bp = Blueprint('feedback_emp', __name__, url_prefix='/feedback')

def current_month_key():
    return datetime.utcnow().strftime('%Y-%m')

def _is_safe_next(url: str) -> bool:
    """Only allow internal relative URLs like '/payroll/...'. Prevents open redirects."""
    try:
        p = urlparse(url or '')
        return (p.scheme == '' and p.netloc == '' and url.startswith('/'))
    except Exception:
        return False

@feedback_emp_bp.get('/form')
@login_required
def form():
    # allow explicit month override (e.g., for a past month’s slip)
    month = request.args.get('month') or current_month_key()
    next_url = request.args.get('next', '')

    questions = (FeedbackQuestion.query
                 .filter_by(is_active=True)
                 .order_by(FeedbackQuestion.id.asc())
                 .all())

    # If already submitted, show banner & an optional "Continue" to next_url
    existing = FeedbackResponse.query.filter_by(employee_id=current_user.id, month=month).first()

    return render_template(
        'feedback/form_dynamic.html',
        month=month,
        questions=questions,
        next_url=next_url if _is_safe_next(next_url) else '',
        already_submitted=bool(existing)
    )


@feedback_emp_bp.post('/form')
@login_required
def submit():
    month = request.form.get('month') or current_month_key()
    is_anonymous = bool(request.form.get('anonymous'))
    next_url = request.form.get('next')  # keep the redirect target

    # prevent duplicate per employee/month (either non-anon or anon by same person)
    from sqlalchemy import or_
    existing = (FeedbackResponse.query
                .filter(FeedbackResponse.month == month)
                .filter(or_(
                    FeedbackResponse.employee_id == current_user.id,
                    FeedbackResponse.submitted_by_id == current_user.id
                ))
                .first())
    if existing:
        flash('You have already submitted feedback for this month.', 'warning')
        return redirect(next_url or url_for('feedback_emp.form', month=month))

    resp = FeedbackResponse(
        employee_id=None if is_anonymous else current_user.id,
        submitted_by_id=current_user.id,     # <- key line
        month=month,
        is_anonymous=is_anonymous
    )
    db.session.add(resp)
    db.session.flush()

    # iterate active questions
    qs = FeedbackQuestion.query.filter_by(is_active=True).all()
    for q in qs:
        field = f"q_{q.id}"
        if q.qtype == 'text':
            txt = (request.form.get(field) or '').strip()
            if txt:
                db.session.add(FeedbackAnswer(response_id=resp.id, question_id=q.id, answer_text=txt))

        elif q.qtype == 'single':
            opt_id = request.form.get(field)
            if opt_id:
                db.session.add(FeedbackAnswer(response_id=resp.id, question_id=q.id, selected_option_id=int(opt_id)))

        elif q.qtype == 'multi':
            opt_ids = request.form.getlist(field)
            if opt_ids:
                ans = FeedbackAnswer(response_id=resp.id, question_id=q.id)
                db.session.add(ans)
                db.session.flush()
                rows = [FeedbackAnswerOption(answer_id=ans.id, option_id=int(oid)) for oid in opt_ids]
                db.session.bulk_save_objects(rows)

    db.session.commit()
    flash('✅ Feedback submitted. Thank you!', 'success')

    # Redirect back to the action that triggered feedback
    if _is_safe_next(next_url):
        return redirect(next_url)

    # Fallback: return to form for the same month
    return redirect(url_for('feedback_emp.form', month=month))