#Flask-WTF 插件：表单类定义与 CSRF 防护

# ❌ 原始表单：手动取数据、零验证、零防护
@app.route("/register", methods=["GET", "POST"])
def register():
    if request.method == "POST":
        name = request.form.get("name")
        email = request.form.get("email")
        # 毫无验证 —— 空字段、格式错误、超长字符串统统接收入库
        # 全部是字符串 —— 需要手动转换类型
        # 不存在 CSRF 防护 —— 攻击者可以轻易伪造请求

# app/__init__.py
from flask import Flask
from flask_wtf.csrf import CSRFProtect

csrf = CSRFProtect()

def create_app():
    app = Flask(__name__)
    # 从环境变量获取密钥，开发阶段可写临时值
    app.config["SECRET_KEY"] = "dev-mode-only-secret-key-12345"
    csrf.init_app(app)
    return app

# app/forms/auth.py
from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, BooleanField, SubmitField
from wtforms.validators import DataRequired, Email, Length, EqualTo, ValidationError
from app.models import User  # 假设已经有了用户模型

class RegisterForm(FlaskForm):
    name = StringField("用户名", validators=[
        DataRequired(message="用户名不能为空"),
        Length(min=2, max=20, message="长度需在 2-20 个字符之间"),
    ])
    email = StringField("邮箱", validators=[
        DataRequired(message="请填写邮箱"),
        Email(message="邮箱格式不正确"),
    ])
    password = PasswordField("密码", validators=[
        DataRequired(message="请输入密码"),
        Length(min=8, message="密码至少需要 8 位"),
    ])
    password_confirm = PasswordField("确认密码", validators=[
        DataRequired(message="请再次输入密码"),
        EqualTo("password", message="两次密码不一致"),
    ])
    agree_terms = BooleanField("我已阅读并同意《用户协议》", validators=[
        DataRequired(message="必须勾选协议才能注册"),
    ])
    submit = SubmitField("立即注册")

    # 自定义验证器：方法名必须是 validate_<field_name>
    def validate_email(self, field):
        # field.data 是用户提交的实际值
        if User.query.filter_by(email=field.data).first():
            raise ValidationError("这个邮箱已经被注册了，试试登录或换一个吧")

# app/forms/content.py
from flask_wtf import FlaskForm
from wtforms import StringField, TextAreaField, SelectField, BooleanField, SubmitField
from wtforms.validators import DataRequired, Length

class ArticleForm(FlaskForm):
    title = StringField("文章标题", validators=[
        DataRequired(message="标题不能为空"),
        Length(max=200, message="标题不能超过 200 字"),
    ])
    summary = StringField("文章摘要", description="简要介绍，会展示在列表中（可选）", validators=[
        Length(max=300, message="摘要不能超过 300 字"),
    ])
    content = TextAreaField("正文", validators=[
        DataRequired(message="正文不能空"),
        Length(min=10, message="正文至少 10 个字"),
    ])
    # coerce=int 会把提交的字符串自动转成整数，方便和数据库主键匹配
    category = SelectField("文章分类", coerce=int, validators=[
        DataRequired(message="请选择一个分类"),
    ])
    tags = StringField("文章标签", description="多个标签用英文逗号分隔")
    is_published = BooleanField("立即发布")
    submit = SubmitField("保存草稿")
    publish_now = SubmitField("立即发布")   # 第二个提交按钮，允许多流程

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        # 延迟导入，避免循环依赖
        from app.models import Category
        # choices 需要 (value, label) 元组列表
        self.category.choices = [(c.id, c.name) for c in Category.query.all()]

# app/routes/auth.py
from flask import Blueprint, render_template, redirect, url_for, flash, request
from flask_login import login_user, logout_user, current_user
from werkzeug.security import generate_password_hash, check_password_hash
from app.forms.auth import LoginForm, RegisterForm
from app.models import User
from app.extensions import db

auth_bp = Blueprint("auth", __name__)

@auth_bp.route("/register", methods=["GET", "POST"])
def register():
    if current_user.is_authenticated:
        return redirect(url_for("main.index"))

    form = RegisterForm()
    if form.validate_on_submit():
        # 拿到的是已验证、已清洗的数据
        user = User(
            name=form.name.data,
            email=form.email.data,
            password_hash=generate_password_hash(form.password.data),
        )
        db.session.add(user)
        db.session.commit()
        flash("注册成功！现在可以登录了", "success")
        return redirect(url_for("auth.login"))

    # GET 或验证失败会走到这里，form 对象会自动携带错误信息
    return render_template("auth/register.html", form=form)

@auth_bp.route("/login", methods=["GET", "POST"])
def login():
    if current_user.is_authenticated:
        return redirect(url_for("main.index"))
    form = LoginForm()
    if form.validate_on_submit():
        user = User.query.filter_by(email=form.email.data).first()
        if user and check_password_hash(user.password_hash, form.password.data):
            login_user(user, remember=form.remember_me.data)
            flash("登录成功！", "success")
            next_page = request.args.get("next")
            return redirect(next_page or url_for("main.index"))
        else:
            flash("邮箱或密码不正确", "danger")
    return render_template("auth/login.html", form=form)

# 在创建文章的路由中
if form.validate_on_submit():
    article = Article(
        title=form.title.data,
        summary=form.summary.data,
        content=form.content.data,
        category_id=form.category.data,
        tags=form.tags.data,
        author_id=current_user.id,
    )
    if form.publish_now.data:          # 用户点击了"立即发布"
        article.is_published = True
        flash("文章发布成功！", "success")
    else:                              # 用户点击了"保存草稿"
        article.is_published = False
        flash("文章已保存为草稿", "info")

    db.session.add(article)
    db.session.commit()
    return redirect(url_for("content.my_articles"))

from app.extensions import csrf

# 针对单个视图函数关闭 CSRF
@csrf.exempt
@content_bp.route("/api/wechat/pay/callback", methods=["POST"])
def wechat_pay_callback():
    # 这里通常会用签名验证来保证安全，比 CSRF 更可靠
    pass

csrf.exempt(api_bp)