#Flask-WTF 插件：表单类定义与 CSRF 防护

# ❌ 原始表单：脏活累活一把抓，防不住乱搞
@app.route("/register", methods=["GET", "POST"])
def register():
    if request.method == "POST":
        name = request.form.get("name")
        email = request.form.get("email")
        # 没验证：空值、无效邮箱、长度不对全接
        # 没转换：全是字符串，没法直接存数据库数字
        # 没防护：随便写个第三方脚本就能删你的数据

# app/__init__.py（示例项目结构为工厂函数）
from flask import Flask
from flask_wtf.csrf import CSRFProtect

# 单独实例化 CSRF，方便工厂函数后续挂载
csrf = CSRFProtect()

def create_app():
    app = Flask(__name__)
    # 密钥建议从环境变量读取（生产环境必须！）
    app.config["SECRET_KEY"] = "dev-mode-only-secret-key-12345"
    csrf.init_app(app)
    return app

# app/forms/auth.py（表单统一放在 forms 目录下，按模块分类）
from flask_wtf import FlaskForm
from wtforms import (
    StringField, PasswordField, BooleanField, SubmitField
)
from wtforms.validators import (
    DataRequired, Email, Length, EqualTo, ValidationError
)
from app.models import User  # 假设 models 里有 User 模型

class RegisterForm(FlaskForm):
    # StringField：文本输入框，第一个参数是标签文本
    name = StringField("用户名", validators=[
        DataRequired(message="请输入用户名"),  # 空值校验
        Length(min=2, max=20, message="长度要在 2-20 个字符之间"),
    ])
    email = StringField("邮箱", validators=[
        DataRequired(message="请输入邮箱"),
        Email(message="请填写有效的邮箱格式"),
    ])
    password = PasswordField("密码", validators=[
        DataRequired(message="请设置密码"),
        Length(min=8, message="密码至少要有 8 位"),
    ])
    password_confirm = PasswordField("确认密码", validators=[
        DataRequired(message="请再次输入密码"),
        EqualTo("password", message="两次输入的密码不一致"),
    ])
    agree_terms = BooleanField("我已阅读并同意《用户协议》", validators=[
        DataRequired(message="请先勾选协议"),
    ])
    submit = SubmitField("立即注册")

    # 自定义验证：检查邮箱是否已被注册
    def validate_email(self, field):
        # field.data 是当前字段的提交值
        if User.query.filter_by(email=field.data).first():
            raise ValidationError("这个邮箱已经注册过啦")

# app/forms/content.py
from flask_wtf import FlaskForm
from wtforms import (
    StringField, TextAreaField, SelectField, BooleanField, SubmitField
)
from wtforms.validators import DataRequired, Length

class ArticleForm(FlaskForm):
    title = StringField("文章标题", validators=[
        DataRequired(message="标题不能空"),
        Length(max=200, message="标题太长啦，最多 200 字"),
    ])
    summary = StringField("文章摘要", description="可选，用逗号分隔标签？不，用下方的tags", validators=[
        Length(max=300, message="摘要最多 300 字"),
    ])
    content = TextAreaField("文章正文", validators=[
        DataRequired(message="正文得写点东西吧"),
        Length(min=10, message="正文太短啦，至少 10 字"),
    ])
    # coerce=int：把提交的字符串转成整数，方便和数据库的分类 id 匹配
    category = SelectField("文章分类", coerce=int, validators=[
        DataRequired(message="请选个分类"),
    ])
    tags = StringField("文章标签", description="用英文逗号分隔多个标签")
    is_published = BooleanField("立即发布")
    # 默认保存草稿，立即发布按钮可以通过提交值判断（后面路由讲）
    submit = SubmitField("保存草稿")
    publish_now = SubmitField("立即发布")

    # 动态加载分类选项
    def __init__(self, *args, **kwargs):
        # 先调用父类的 __init__
        super().__init__(*args, **kwargs)
        # 避免循环导入，在 __init__ 里单独引入
        from app.models import Category
        # choices 是元组列表：(提交值, 显示文本)
        self.category.choices = [(c.id, c.name) for c in Category.query.all()]

# app/routes/auth.py
from flask import Blueprint, render_template, redirect, url_for, flash, request
from flask_login import login_user, logout_user, current_user
from werkzeug.security import generate_password_hash, check_password_hash
from app.forms.auth import LoginForm, RegisterForm
from app.models import User
from app.extensions import db

auth_bp = Blueprint("auth", __name__)

@auth_bp.route("/register", methods=["GET", "POST"])
def register():
    # 如果用户已登录，直接跳转到首页
    if current_user.is_authenticated:
        return redirect(url_for("main.index"))
    form = RegisterForm()
    # validate_on_submit() = (request.method == "POST") + (form.validate())
    if form.validate_on_submit():
        # 验证通过，用 form.字段名.data 获取清洗后的值
        user = User(
            name=form.name.data,
            email=form.email.data,
            password_hash=generate_password_hash(form.password.data),
        )
        db.session.add(user)
        db.session.commit()
        # 用 flash 给用户提示（需要在模板里配合 get_flashed_messages 使用）
        flash("注册成功！现在可以登录啦", "success")
        return redirect(url_for("auth.login"))
    # 如果是 GET 请求或验证失败，渲染带表单的页面
    return render_template("auth/register.html", form=form)

@auth_bp.route("/login", methods=["GET", "POST"])
def login():
    if current_user.is_authenticated:
        return redirect(url_for("main.index"))
    form = LoginForm()
    if form.validate_on_submit():
        user = User.query.filter_by(email=form.email.data).first()
        if user and check_password_hash(user.password_hash, form.password.data):
            login_user(user, remember=form.remember_me.data)
            flash("登录成功！", "success")
            # 处理登录后跳转（比如用户之前访问过需要登录的页面）
            next_page = request.args.get("next")
            return redirect(next_page or url_for("main.index"))
        else:
            flash("邮箱或密码不对哦", "danger")
    return render_template("auth/login.html", form=form)

# 假设在 content_bp 的 /article/create 路由里
if form.validate_on_submit():
    article = Article(
        title=form.title.data,
        summary=form.summary.data,
        content=form.content.data,
        category_id=form.category.data,
        tags=form.tags.data,
        author_id=current_user.id,
    )
    # 判断哪个按钮被点击
    if form.publish_now.data:
        article.is_published = True
        flash("文章发布成功！", "success")
    else:
        article.is_published = False
        flash("文章保存为草稿啦", "info")
    db.session.add(article)
    db.session.commit()
    return redirect(url_for("content.my_articles"))

from app.extensions import csrf

# 1. 仅对单个端点禁用
@csrf.exempt
@content_bp.route("/api/wechat/pay/callback", methods=["POST"])
def wechat_pay_callback():
    # 验证回调的签名（第三方 API 通常有自己的验证方式，比 CSRF 更安全）
    pass

# 2. 对某个 Blueprint 下的所有端点禁用
csrf.exempt(content_api_bp)