# ============================================================
#  routers/rgpd.py — Droits de la personne concernée (RGPD)
# ============================================================

from fastapi import APIRouter, Depends

from auth import get_current_user
from config import get_cursor
from helpers import row_to_dict, rows_to_list

router = APIRouter(tags=["RGPD"])


@router.get("/me/data-export")
def export_my_data(user: dict = Depends(get_current_user)):
    """Droit à la portabilité (art. 20) : export des données de l'utilisateur."""
    with get_cursor() as cursor:
        cursor.execute(
            "SELECT id_user, username, email, role, actif, created_at, last_login "
            "FROM [USER] WHERE username = ?", user["username"]
        )
        u = cursor.fetchone()
        profile = row_to_dict(cursor, u) if u else {}
        cursor.execute(
            "SELECT date_action, action, detail, ip FROM JOURNAL_AUDIT "
            "WHERE username = ? ORDER BY date_action DESC", user["username"]
        )
        journal = rows_to_list(cursor, cursor.fetchall())
    return {"profile": profile, "journal": journal}


@router.delete("/me")
def delete_my_account(user: dict = Depends(get_current_user)):
    """Droit à l'oubli (art. 17) : désactivation + anonymisation."""
    with get_cursor() as cursor:
        cursor.execute(
            "UPDATE [USER] SET actif = 0, "
            "username = CONCAT('deleted_', id_user), "
            "email = CONCAT('deleted_', id_user, '@deleted.local') "
            "WHERE username = ?", user["username"]
        )
        cursor.execute("UPDATE JOURNAL_AUDIT SET username = NULL WHERE username = ?", user["username"])
    return {"status": "account_deleted"}