#Flask-WTF 插件：表单类定义与 CSRF 防护

# ❌ 原始表单：手动处理，数据脏乱
@app.route("/register", methods=["GET", "POST"])
def register():
    if request.method == "POST":
        name = request.form.get("name")
        email = request.form.get("email")
        # 没有验证、没有类型转换、容易出错

# app/__init__.py
from flask_wtf.csrf import CSRFProtect

csrf = CSRFProtect()

def create_app():
    app = Flask(__name__)
    app.config["SECRET_KEY"] = "your-secret-key"  # 必须设置！用于 CSRF 签名
    csrf.init_app(app)

# app/forms/auth.py
from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, BooleanField, SubmitField
from wtforms.validators import DataRequired, Email, Length, EqualTo, ValidationError
from app.models import User

class RegisterForm(FlaskForm):
    name = StringField("用户名", validators=[
        DataRequired(message="用户名不能为空"),
        Length(min=2, max=20, message="用户名长度需在 2-20 个字符之间"),
    ])
    email = StringField("邮箱", validators=[
        DataRequired(message="邮箱不能为空"),
        Email(message="请输入有效的邮箱地址"),
    ])
    password = PasswordField("密码", validators=[
        DataRequired(message="密码不能为空"),
        Length(min=8, message="密码至少 8 个字符"),
    ])
    password_confirm = PasswordField("确认密码", validators=[
        DataRequired(message="请再次输入密码"),
        EqualTo("password", message="两次输入的密码不一致"),
    ])
    agree_terms = BooleanField("我已阅读并同意《用户协议》", validators=[
        DataRequired(message="请勾选用户协议"),
    ])
    submit = SubmitField("注册")

    # 自定义验证：检查邮箱是否已被注册
    def validate_email(self, field):
        if User.query.filter_by(email=field.data).first():
            raise ValidationError("该邮箱已被注册")

class LoginForm(FlaskForm):
    email = StringField("邮箱", validators=[
        DataRequired(message="邮箱不能为空"),
        Email(message="请输入有效的邮箱地址"),
    ])
    password = PasswordField("密码", validators=[
        DataRequired(message="密码不能为空"),
    ])
    remember_me = BooleanField("记住我")
    submit = SubmitField("登录")

class ArticleForm(FlaskForm):
    title = StringField("标题", validators=[
        DataRequired(message="标题不能为空"),
        Length(max=200, message="标题最多 200 个字符"),
    ])
    summary = StringField("摘要", validators=[
        Length(max=300, message="摘要最多 300 个字符"),
    ])
    content = TextAreaField("正文", validators=[
        DataRequired(message="正文不能为空"),
        Length(min=10, message="正文至少 10 个字符"),
    ])
    category = SelectField("分类", coerce=int, validators=[
        DataRequired(message="请选择分类"),
    ])
    tags = StringField("标签", description="用逗号分隔多个标签")
    is_published = BooleanField("立即发布")
    submit = SubmitField("保存草稿")

    # 动态设置 category 选项
    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        from app.models import Category
        self.category.choices = [(c.id, c.name) for c in Category.query.all()]

# app/routes/auth.py
from flask import render_template, redirect, url_for, flash
from flask_login import login_user, logout_user
from app.forms.auth import LoginForm, RegisterForm
from app.models import User
from app.extensions import db

@auth_bp.route("/register", methods=["GET", "POST"])
def register():
    form = RegisterForm()
    if form.validate_on_submit():
        # 表单数据全部验证通过
        user = User(
            name=form.name.data,
            email=form.email.data,
            password_hash=generate_password_hash(form.password.data),  # 后续章节
        )
        db.session.add(user)
        db.session.commit()
        flash("注册成功！请登录。", "success")
        return redirect(url_for("auth.login"))
    return render_template("auth/register.html", form=form)

@auth_bp.route("/login", methods=["GET", "POST"])
def login():
    form = LoginForm()
    if form.validate_on_submit():
        user = User.query.filter_by(email=form.email.data).first()
        if user and check_password_hash(user.password_hash, form.password.data):
            login_user(user, remember=form.remember_me.data)
            flash("登录成功！", "success")
            next_page = request.args.get("next")
            return redirect(next_page or url_for("main.index"))
        else:
            flash("邮箱或密码错误", "danger")
    return render_template("auth/login.html", form=form)

# validate_on_submit() = (request.method == "POST") and form.validate()
# 推荐用法：GET 请求时返回 False，不做验证

# validate() 单独使用：每次请求都验证（调试用）

# 仅对特定端点禁用
@csrf.exempt
@app.route("/api/webhook", methods=["POST"])
def webhook():
    # Webhook 来自第三方，无法提供 CSRF token
    pass