app.py

import os
import json
import re
import secrets
from pathlib import Path
from datetime import datetime, timedelta, timezone
from typing import Optional
from urllib.parse import unquote, urlencode, urlsplit

from fastapi import FastAPI, Form, HTTPException, Request
from fastapi.middleware.cors import CORSMiddleware
from fastapi.responses import HTMLResponse, RedirectResponse, JSONResponse, Response
from fastapi.staticfiles import StaticFiles
from fastapi.templating import Jinja2Templates
from fastapi.exception_handlers import http_exception_handler
from starlette.exceptions import HTTPException as StarletteHTTPException
from starlette.middleware.sessions import SessionMiddleware
from sqlalchemy import func
from sqlalchemy.exc import IntegrityError, SQLAlchemyError
from sqlalchemy.orm import Session
import requests

from database import SessionLocal
from models import (
    DeveloperProfile,
    Event,
    MaintainerAnalysis,
    OpportunityFeedItem,
    Target,
    User,
)
from auth import (
    hash_password,
    verify_password,
    generate_csrf_token,
    verify_csrf_token,
)
from analytics import (
    analytics_summary,
    track_analysis,
    update_pipeline_status,
    generate_pitch,
    save_pitch,
    daily_analysis_count,
    lifetime_analysis_count,
)
import paddle_billing
import email_utils
import pricing
from analysis_service import build_analysis_result, contract_potential, to_public_api_payload
from radar import OPPORTUNITY_SCORE_COMPONENTS, RECOMMENDATION_RULES
from discovery_service import DiscoveryError, category_options, discover_opportunities
from maintainer_schemas import MaintainerReport
from maintainer_service import ANALYSIS_VERSION as MAINTAINER_ANALYSIS_VERSION
from maintainer_service import MaintainerServiceError, build_maintainer_report, parse_repository_url
from developer_profile_service import (
    OWNER_REFRESH_HOURS,
    PROFILE_CACHE_HOURS,
    DeveloperProfileError,
    analyze_developer_profile,
    normalize_github_username,
)
from opportunity_service import (
    DISMISS_COOLDOWN_DAYS,
    FREE_RECOMMENDATION_LIMIT,
    PRO_RECOMMENDATION_LIMIT,
    PUBLIC_RECOMMENDATION_LIMIT,
    OpportunityFeedError,
    can_save_more,
    curated_opportunity_sections,
    feed_freshness,
    interaction_ids,
    load_feed_items,
    normalize_repository_full_name,
    ranked_recommendations,
    public_opportunity_payload,
    recently_viewed_items,
    refresh_opportunity_feed,
    saved_items,
    upsert_interaction,
)
from share_card_service import render_developer_profile_card, render_opportunity_card
import config

try:
    import google.generativeai as genai
except Exception:
    genai = None


# SECRET_KEY is required, not defaulted. A hardcoded fallback would mean
# every session cookie (and CSRF token) is forgeable if the env var is ever
# missing on deploy. Fail loudly at startup instead of failing silently in
# production.
SECRET_KEY = os.environ.get("SECRET_KEY")
if not SECRET_KEY:
    raise RuntimeError(
        "SECRET_KEY environment variable is not set. Set it before starting "
        "the app (e.g. `SECRET_KEY=$(openssl rand -hex 32)`). Refusing to "
        "start with an insecure default."
    )

app = FastAPI(title="BashOps Radar")

app.add_middleware(
    CORSMiddleware,
    allow_origin_regex=r"^chrome-extension://[a-p]{32}$",
    allow_credentials=False,
    allow_methods=["GET"],
    allow_headers=["Accept"],
)


def session_cookie_https_only(site_url: str) -> bool:
    """Keep production cookies HTTPS-only while allowing explicit HTTP local URLs."""
    try:
        return urlsplit(site_url).scheme.casefold() == "https"
    except (TypeError, ValueError):
        return False


app.add_middleware(
    SessionMiddleware,
    secret_key=SECRET_KEY,
    https_only=session_cookie_https_only(config.SITE_URL),
    same_site="lax",
)

app.mount("/static", StaticFiles(directory="static"), name="static")
templates = Jinja2Templates(directory="templates")

GEMINI_API_KEY = os.getenv("GEMINI_API_KEY")
BETA_FILE = Path("beta_signups.csv")
FREE_ANALYSIS_LIMIT = 2
ANONYMOUS_ANALYSIS_LIMIT = 1
MAINTAINER_PENDING_PARTIAL_SESSION_KEY = "maintainer_pending_partial"
POST_AUTH_NEXT_SESSION_KEY = "post_auth_next"
GITHUB_OAUTH_NEXT_SESSION_KEY = "github_oauth_next"
EMAIL_VERIFICATION_MAX_AGE_SECONDS = 24 * 60 * 60
PASSWORD_RESET_MAX_AGE_SECONDS = 60 * 60
ANONYMOUS_DEVELOPER_PROFILE_LIMIT = 3
ANONYMOUS_DEVELOPER_PROFILE_WINDOW_SECONDS = 60 * 60

if GEMINI_API_KEY and genai:
    genai.configure(api_key=GEMINI_API_KEY)


def clean_ai_summary_text(text: str) -> str:
    """Keep model output readable in the HTML card without touching GitHub data."""
    if not text:
        return "AI summary temporarily unavailable."

    cleaned = text.strip()
    cleaned = re.sub(r"^\s*#{1,6}\s*", "", cleaned, flags=re.MULTILINE)
    cleaned = re.sub(r"^\s*[-*]\s+", "", cleaned, flags=re.MULTILINE)
    cleaned = re.sub(r"\*\*(.*?)\*\*", r"\1", cleaned)
    cleaned = re.sub(r"__(.*?)__", r"\1", cleaned)
    cleaned = re.sub(r"`([^`]+)`", r"\1", cleaned)
    cleaned = cleaned.replace("**", "").replace("__", "")
    cleaned = re.sub(r"\n{3,}", "\n\n", cleaned)
    unsafe_outcome = re.compile(
        r"\b(?:will|would|guaranteed?|definitely|certainly|ensures?)\b"
        r"[^.!?]{0,100}\b(?:merge|accept|hire|job|contract|pay|paid|notice|attention|respond|reply)\w*",
        flags=re.IGNORECASE,
    )
    safe_sentences = [
        sentence
        for sentence in re.split(r"(?<=[.!?])\s+", cleaned.strip())
        if sentence and not unsafe_outcome.search(sentence)
    ]
    return " ".join(safe_sentences).strip() or "AI interpretation temporarily unavailable."


def generate_ai_summary(
    repo_full_name,
    repo,
    best_issue,
    repo_score,
    angle,
    languages=None,
    repository_intelligence=None,
    confidence=None,
    recommendation_label=None,
):
    if not GEMINI_API_KEY or not genai:
        return {
            "text": "AI interpretation is temporarily unavailable. Deterministic repository analysis remains available.",
            "status": "unavailable",
        }

    issue_text = "No best issue found."
    if best_issue:
        issue_text = (
            f"#{best_issue['number']} - {best_issue['title']} "
            f"({best_issue['type']}, score {best_issue['score']}/100)"
        )

    intelligence = {item.get("key"): item for item in (repository_intelligence or [])}
    commercial = intelligence.get("commercial") or {}
    friendliness = intelligence.get("friendliness") or {}
    language_names = ", ".join(list((languages or {}).keys())[:4]) or "Unavailable"
    purpose = repo.get("description") or "Repository purpose unavailable"
    activity = repo.get("pushed_at") or "Unavailable"

    prompt = f"""
You are BashOps Radar, an AI opportunity analyst for developers.

Interpret the deterministic public evidence below as a proof-of-work opportunity.
Do not repeat the numeric score or recommendation. Do not invent missing facts.

Repository: {repo_full_name}
Repository purpose: {purpose}
Languages: {language_names}
Stars: {repo.get("stargazers_count")}
Forks: {repo.get("forks_count")}
Open Issues: {repo.get("open_issues_count")}
Last push: {activity}
Opportunity Score: {repo_score}/100
Confidence: {confidence or "Unavailable"}
Deterministic recommendation: {recommendation_label or "Unavailable"}
Best Issue: {issue_text}
Proof-of-Work Angle: {angle}
Contributor friendliness: {friendliness.get("value") or "Unavailable"} - {friendliness.get("detail") or "No sampled signal"}
Commercial context: {commercial.get("value") or "Unavailable"} - {commercial.get("detail") or "No public metadata signal"}

Write one or two concise plain-text paragraphs that add project-specific interpretation:
- connect the repository purpose and language to the named issue category and title;
- state what the developer should verify before beginning;
- describe a focused contribution approach;
- mention paid-work potential only as a conditional possibility after maintainer trust is established.

If the repository purpose or best issue is unavailable, use one short paragraph and state the limitation.
Never promise attention, merge, employment, a contract, or maintainer response.
Keep it practical, direct, and under 120 words.
Do not use Markdown, headings, bold markers, bullets, numbered lists, or code formatting.
"""

    try:
        model = genai.GenerativeModel("gemini-2.5-flash-lite")
        response = model.generate_content(prompt)
        cleaned_summary = clean_ai_summary_text(response.text if response.text else "")
        return {
            "text": cleaned_summary,
            "status": "unavailable" if cleaned_summary == "AI interpretation temporarily unavailable." else "available",
        }

    except Exception as e:
        error = str(e).lower()

        if "429" in error or "quota" in error or "rate limit" in error:
            return {
                "text": "Gemini free-tier quota reached. Core repository analysis completed successfully.",
                "status": "unavailable",
            }

        return {
            "text": "AI summary temporarily unavailable. Core repository analysis completed successfully.",
            "status": "unavailable",
        }


def get_current_user(request: Request):
    user_id = request.session.get("user_id")

    if not user_id:
        return None

    db: Session = SessionLocal()
    try:
        return db.query(User).filter(User.id == user_id).first()
    finally:
        db.close()


def is_admin(user) -> bool:
    return bool(user and user.email and user.email.strip().lower() in config.ADMIN_EMAILS)


def has_owner_pro_override(user) -> bool:
    if not user or not user.email:
        return False
    email = user.email.strip().lower()
    return email == "bashops1@gmail.com" or email in config.ADMIN_EMAILS


def has_pro_access(user) -> bool:
    return bool(
        user
        and (
            user.plan in {pricing.RADAR_PRO_PLAN, pricing.LEGACY_RADAR_PRO_PLAN}
            or has_owner_pro_override(user)
        )
    )


def require_admin_or_redirect(request: Request, current_user):
    if not current_user:
        return RedirectResponse(url="/login", status_code=303)
    if not is_admin(current_user):
        return HTMLResponse(
            "Admin access required. Confirm this account email is listed in ADMIN_EMAILS.",
            status_code=403,
        )
    return None


def user_context(request: Request, current_user=None) -> dict:
    """Standard current_user / is_admin pair every template needs for the
    navbar to render the right links."""
    if current_user is None:
        current_user = get_current_user(request)
    pro_access = has_pro_access(current_user)
    return {
        "current_user": current_user,
        "is_admin": is_admin(current_user),
        "has_pro_access": pro_access,
        "effective_plan": pricing.RADAR_PRO_PLAN if pro_access else pricing.FREE_PLAN,
        "maintainer_enabled": config.MAINTAINER_ENABLED,
    }


def csrf_context(request: Request) -> dict:
    """Every template that renders a POST form should merge this in so the
    form can include the hidden csrf_token field."""
    token = generate_csrf_token()
    request.session["csrf_token"] = token
    return {"csrf_token": token}


def check_csrf(request: Request, csrf_token: str) -> bool:
    session_token = request.session.get("csrf_token", "")
    # The token must both verify its own signature/expiry AND match the one
    # issued for this session, so a stolen token from a different session
    # can't be replayed.
    return verify_csrf_token(csrf_token) and csrf_token == session_token


def now_utc() -> datetime:
    return datetime.now(timezone.utc)


def token_age_seconds(sent_at) -> float:
    if not sent_at:
        return float("inf")
    if sent_at.tzinfo is None:
        sent_at = sent_at.replace(tzinfo=timezone.utc)
    return (now_utc() - sent_at).total_seconds()


def validate_password_strength(password: str) -> Optional[str]:
    if len(password or "") < 8:
        return "Password must be at least 8 characters long."
    if not any(char.isupper() for char in password):
        return "Password must include at least one uppercase letter."
    if not any(char.islower() for char in password):
        return "Password must include at least one lowercase letter."
    if not any(char.isdigit() for char in password):
        return "Password must include at least one number."
    return None


def safe_next_path(value: str, default: str = "/dashboard") -> str:
    """Return a local BashOps path or the existing dashboard fallback."""
    candidate = (value or "").strip()
    if not candidate or "\\" in candidate or any(ord(char) < 32 for char in candidate):
        return default

    # Query parsing decodes once. Decode a few more times so double-encoded
    # protocol-relative and backslash redirects cannot survive validation.
    for _ in range(3):
        decoded = unquote(candidate)
        if decoded == candidate:
            break
        candidate = decoded

    if "%" in candidate or "\\" in candidate or any(ord(char) < 32 for char in candidate):
        return default

    parsed = urlsplit(candidate)
    if parsed.scheme or parsed.netloc or not candidate.startswith("/") or candidate.startswith("//"):
        return default
    return candidate


def user_by_email(db: Session, email: str):
    normalized_email = (email or "").strip().lower()
    return db.query(User).filter(func.lower(User.email) == normalized_email).first()


def auth_url(path: str, next_path: str, **params) -> str:
    values = {**params, "next": safe_next_path(next_path)}
    return f"{path}?{urlencode(values)}"


def new_token() -> str:
    return secrets.token_urlsafe(48)


def verification_link(token: str) -> str:
    return f"{config.SITE_URL}/verify-email?token={token}"


def reset_link(token: str) -> str:
    return f"{config.SITE_URL}/reset-password?token={token}"


def render_login(
    request: Request,
    error: Optional[str] = None,
    joined: bool = False,
    registered: bool = False,
    verified: bool = False,
    reset: bool = False,
    next_path: str = "/dashboard",
):
    next_path = safe_next_path(next_path)
    return templates.TemplateResponse(
        request=request,
        name="login.html",
        context={
            "joined": joined,
            "registered": registered,
            "verified": verified,
            "reset": reset,
            "error": error,
            "next_path": next_path,
            "is_maintainer_destination": next_path.startswith("/maintainer"),
            "register_url": auth_url("/register", next_path),
            "github_login_url": auth_url("/auth/github/login", next_path),
            "github_oauth_configured": config.github_oauth_configured,
            **user_context(request),
            **csrf_context(request),
        },
    )


def render_register(
    request: Request,
    error: Optional[str] = None,
    next_path: str = "/dashboard",
    account_exists: bool = False,
):
    next_path = safe_next_path(next_path)
    return templates.TemplateResponse(
        request=request,
        name="register.html",
        context={
            "error": error,
            "account_exists": account_exists,
            "next_path": next_path,
            "is_maintainer_destination": next_path.startswith("/maintainer"),
            "login_url": auth_url("/login", next_path),
            "github_login_url": auth_url("/auth/github/login", next_path),
            "github_oauth_configured": config.github_oauth_configured,
            **user_context(request),
            **csrf_context(request),
        },
    )


def sanitize_referrer(referrer: str) -> str:
    """Retain attribution without persisting tokens from URL queries/fragments."""
    if not referrer:
        return ""
    try:
        parsed = urlsplit(referrer)
        if parsed.scheme.casefold() not in {"http", "https"} or not parsed.netloc:
            return ""
        if parsed.username or parsed.password:
            return ""
        return parsed._replace(query="", fragment="").geturl()[:500]
    except (TypeError, ValueError):
        return ""


def track_event(request: Request, event_name: str, user=None, metadata=None) -> None:
    try:
        db: Session = SessionLocal()
        try:
            event = Event(
                user_id=user.id if user else None,
                event_name=event_name,
                page=str(request.url.path)[:500],
                referrer=sanitize_referrer(request.headers.get("referer") or ""),
                user_agent=(request.headers.get("user-agent") or "")[:500],
                metadata_json=json.dumps(metadata or {}, default=str),
            )
            db.add(event)
            db.commit()
        finally:
            db.close()
    except Exception as exc:
        print(f"[event tracking failed] {event_name}: {exc!r}")


def user_has_vscode_interest(user) -> bool:
    if not user:
        return False
    db: Session = SessionLocal()
    try:
        return (
            db.query(Event.id)
            .filter(
                Event.user_id == user.id,
                Event.event_name == "vscode_interest_submitted",
            )
            .first()
            is not None
        )
    finally:
        db.close()


def anonymous_website_analysis_used(request: Request, ip: str) -> bool:
    """
    Website-only anonymous trial guard. The session flag is the primary signal;
    the existing anonymous Target/IP count remains a soft fallback for the
    current network without adding fingerprinting or new storage.
    """
    if request.session.get("anonymous_analysis_used"):
        return True
    return daily_analysis_count(ip=ip) >= ANONYMOUS_ANALYSIS_LIMIT


def free_account_analysis_count(user) -> int:
    """Free account quota is derived from successful Target rows."""
    if not user:
        return 0
    return lifetime_analysis_count(user.id)


def require_maintainer_enabled() -> None:
    if not config.MAINTAINER_ENABLED:
        raise HTTPException(status_code=404, detail="Not found")


def has_maintainer_access(user) -> bool:
    return bool(
        user
        and (
            has_owner_pro_override(user)
            or bool(getattr(user, "maintainer_pilot_access", False))
        )
    )


def maintainer_trial_used(request: Request, user, ip: str) -> bool:
    if has_maintainer_access(user):
        return False
    if not user and request.session.get("maintainer_trial_used"):
        return True

    db: Session = SessionLocal()
    try:
        query = db.query(MaintainerAnalysis).filter(
            MaintainerAnalysis.status == "completed",
            MaintainerAnalysis.is_partial.is_(False),
        )
        if user:
            query = query.filter(MaintainerAnalysis.user_id == user.id)
        else:
            query = query.filter(
                MaintainerAnalysis.user_id.is_(None),
                MaintainerAnalysis.ip_address == ip,
            )
        return query.count() >= 1
    finally:
        db.close()


def maintainer_pending_partial_repository(request: Request, user) -> Optional[str]:
    """Return the Free user's session-bound partial repository, if any."""
    if not user or has_maintainer_access(user):
        return None
    pending = request.session.get(MAINTAINER_PENDING_PARTIAL_SESSION_KEY)
    if not isinstance(pending, dict) or pending.get("user_id") != user.id:
        return None
    repository = pending.get("repository")
    return repository if isinstance(repository, str) and repository else None


def maintainer_plan_context(user) -> str:
    if has_owner_pro_override(user):
        return "owner_admin"
    if user and getattr(user, "maintainer_pilot_access", False):
        return "pilot"
    return "registered_trial" if user else "anonymous_trial"


def maintainer_template_context(request: Request, current_user=None) -> dict:
    if current_user is None:
        current_user = get_current_user(request)
    maintainer_access = has_maintainer_access(current_user)
    return {
        **user_context(request, current_user),
        "maintainer_access": maintainer_access,
        "maintainer_effective_plan": (
            pricing.MAINTAINER_PRO_PLAN if maintainer_access else pricing.FREE_PLAN
        ),
        **pricing.template_context(),
        "maintainer_billing_available": bool(
            config.PADDLE_CLIENT_TOKEN
            and (
                pricing.PADDLE_MAINTAINER_MONTHLY_PRICE_ID
                or pricing.PADDLE_MAINTAINER_ANNUAL_PRICE_ID
            )
        ),
        "maintainer_subscription_status": (
            getattr(current_user, "maintainer_subscription_status", None) if current_user else None
        ),
        "site_url": config.SITE_URL,
    }


def _aware_utc(value):
    if value is None:
        return None
    return value.replace(tzinfo=timezone.utc) if value.tzinfo is None else value.astimezone(timezone.utc)


def developer_profile_by_username(db: Session, username: str):
    normalized = (username or "").strip().lower()
    return (
        db.query(DeveloperProfile)
        .filter(
            (func.lower(DeveloperProfile.github_username) == normalized)
            | (func.lower(DeveloperProfile.public_slug) == normalized)
        )
        .first()
    )


def developer_profile_is_fresh(profile) -> bool:
    expires_at = _aware_utc(getattr(profile, "expires_at", None))
    return bool(expires_at and expires_at > now_utc())


def developer_profile_is_owner(profile, user) -> bool:
    return bool(profile and user and profile.user_id == user.id and profile.is_claimed)


def developer_profile_can_be_claimed(profile, user) -> bool:
    providers = {item.strip() for item in (getattr(user, "auth_provider", "") or "").split(",")}
    return bool(
        profile
        and user
        and "github" in providers
        and user.github_id
        and str(user.github_id) == str(profile.github_user_id)
        and (profile.user_id is None or profile.user_id == user.id)
    )


def consume_anonymous_developer_generation(request: Request) -> bool:
    now_timestamp = now_utc().timestamp()
    history = request.session.get("developer_profile_generation_times", [])
    if not isinstance(history, list):
        history = []
    recent = [
        float(value)
        for value in history
        if isinstance(value, (int, float)) and now_timestamp - float(value) < ANONYMOUS_DEVELOPER_PROFILE_WINDOW_SECONDS
    ]
    if len(recent) >= ANONYMOUS_DEVELOPER_PROFILE_LIMIT:
        request.session["developer_profile_generation_times"] = recent
        return False
    recent.append(now_timestamp)
    request.session["developer_profile_generation_times"] = recent
    return True


def apply_developer_profile_analysis(profile, analysis: dict) -> None:
    analyzed_at = now_utc()
    profile.github_username = analysis["github_username"]
    profile.github_user_id = analysis["github_user_id"]
    profile.display_name = analysis["display_name"]
    profile.avatar_url = analysis["avatar_url"]
    profile.bio = analysis["bio"]
    profile.public_location = analysis["public_location"]
    profile.profile_url = analysis["profile_url"]
    profile.profile_data = analysis["profile_data"]
    profile.strength_data = analysis["strength_data"]
    profile.contribution_data = analysis["contribution_data"]
    profile.analyzed_at = analyzed_at
    profile.expires_at = analyzed_at + timedelta(hours=PROFILE_CACHE_HOURS)
    profile.public_slug = analysis["github_username"]


def render_developer_landing(request: Request, error: str = "", username: str = "", status_code: int = 200):
    current_user = get_current_user(request)
    return templates.TemplateResponse(
        request=request,
        name="developer_landing.html",
        context={
            "error": error,
            "username": username,
            "site_url": config.SITE_URL,
            **user_context(request, current_user),
            **csrf_context(request),
        },
        status_code=status_code,
    )


@app.exception_handler(StarletteHTTPException)
async def not_found_handler(request: Request, exc: StarletteHTTPException):
    if exc.status_code == 404:
        return templates.TemplateResponse(
            request=request,
            name="404.html",
            context={**user_context(request)},
            status_code=404,
        )
    # Any other raised HTTPException (403, 401, etc.) keeps FastAPI's
    # default plain response — only 404 gets the branded page, so real
    # status codes used by API-style clients aren't silently reshaped.
    return await http_exception_handler(request, exc)


@app.exception_handler(Exception)
async def server_error_handler(request: Request, exc: Exception):
    # Last-resort safety net: if a route raises anything unhandled, log it
    # server-side and show the branded 500 page instead of a raw traceback
    # or FastAPI's default plain-text error leaking internals to the user.
    print(f"[unhandled error] {request.method} {request.url.path}: {exc!r}")
    return templates.TemplateResponse(
        request=request,
        name="500.html",
        context={**user_context(request)},
        status_code=500,
    )


@app.get("/robots.txt")
def robots_txt():
    lines = [
        "User-agent: *",
        "Allow: /",
        "Disallow: /dashboard",
        "Disallow: /pipeline",
        "Disallow: /admin/",
        "Disallow: /billing/",
        "Disallow: /maintainer/dashboard",
        "Disallow: /maintainer/report/",
        "Disallow: /export-pipeline",
        f"Sitemap: {config.SITE_URL}/sitemap.xml",
    ]
    return Response(content="\n".join(lines) + "\n", media_type="text/plain")


@app.get("/sitemap.xml")
def sitemap_xml():
    # Only the public, indexable marketing pages — the app pages behind
    # login are excluded via robots.txt above and noindex tags on the
    # pages themselves.
    urls = [
        "/",
        "/pricing",
        "/methodology",
        "/tools/github-opportunity-score",
        "/tools/best-first-issue-finder",
        "/developer",
        "/today",
        "/jobs",
        "/login",
        "/register",
        "/terms",
        "/privacy",
        "/refund",
        "/contact",
    ]
    if config.MAINTAINER_ENABLED:
        urls.extend(
            [
                "/maintainer",
                "/maintainer/pricing",
                "/tools/github-maintainer-workload-report",
            ]
        )
    db: Session = SessionLocal()
    try:
        public_slugs = (
            db.query(DeveloperProfile.public_slug)
            .filter(
                DeveloperProfile.is_claimed.is_(True),
                DeveloperProfile.is_public.is_(True),
            )
            .order_by(DeveloperProfile.public_slug)
            .all()
        )
        urls.extend(f"/developer/{slug}" for (slug,) in public_slugs)
    except SQLAlchemyError:
        pass
    finally:
        db.close()
    body = ['<?xml version="1.0" encoding="UTF-8"?>', '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">']
    for path in urls:
        body.append(f"<url><loc>{config.SITE_URL}{path}</loc></url>")
    body.append("</urlset>")
    return Response(content="\n".join(body), media_type="application/xml")


@app.get("/", response_class=HTMLResponse)
def home(request: Request, source: str = "", vscode_interest: str = "", repo_url: str = ""):
    current_user = get_current_user(request)
    if source == "maintainer":
        track_event(request, "maintainer_to_radar_clicked", user=current_user)
    elif source == "extension-analyze":
        track_event(request, "extension_analyze_click", user=current_user)
    track_event(request, "landing_view", user=current_user)
    return templates.TemplateResponse(
        request=request,
        name="index.html",
        context={
            "result": None,
            "error": None,
            "limit_reached": False,
            "site_url": config.SITE_URL,
            "repo_url": repo_url if source == "extension-analyze" else "",
            **pricing.template_context(),
            "vscode_interest_status": vscode_interest if vscode_interest in {"joined", "already", "error"} else "",
            "has_vscode_interest": user_has_vscode_interest(current_user),
            **user_context(request, current_user),
            **csrf_context(request),
        },
    )


@app.get("/export-pipeline")
def export_pipeline(request: Request):
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url="/login", status_code=303)
    if not has_pro_access(current_user):
        track_event(request, "export_blocked", user=current_user, metadata={"reason": "radar_pro_required"})
        return RedirectResponse(url="/pricing", status_code=303)

    import csv
    import io

    summary = analytics_summary(user_id=current_user.id)

    buffer = io.StringIO()
    writer = csv.writer(buffer)
    writer.writerow(["repo", "score", "status", "best_issue", "difficulty", "merge_probability", "estimated_time", "created_at"])
    for row in summary["rows"]:
        writer.writerow([
            row["repo"], row["score"], row["status"], row["best_issue"],
            row["difficulty"], row["merge_probability"], row["estimated_time"], row["pretty_time"],
        ])

    from fastapi.responses import Response
    return Response(
        content=buffer.getvalue(),
        media_type="text/csv",
        headers={"Content-Disposition": "attachment; filename=bashops_pipeline.csv"},
    )


@app.get("/pricing", response_class=HTMLResponse)
def pricing_page(request: Request, source: str = ""):
    current_user = get_current_user(request)
    track_event(request, "pricing_view", user=current_user)
    if source == "opportunity":
        track_event(request, "opportunity_upgrade_clicked", user=current_user)
    return templates.TemplateResponse(
        request=request,
        name="pricing.html",
        context={
            "result": None,
            "error": None,
            "limit_reached": False,
            **pricing.template_context(),
            "billing_error": None,
            "site_url": config.SITE_URL,
            **user_context(request, current_user),
        },
    )


@app.get("/methodology", response_class=HTMLResponse)
def methodology_page(request: Request):
    """Public technical documentation for Radar's deterministic score."""
    current_user = get_current_user(request)
    return templates.TemplateResponse(
        request=request,
        name="methodology.html",
        context={
            "score_components": OPPORTUNITY_SCORE_COMPONENTS,
            "recommendation_rules": RECOMMENDATION_RULES,
            "evidence_config": {
                "open_pull_sample": config.EVIDENCE_OPEN_PR_SAMPLE,
                "closed_pull_sample": config.EVIDENCE_CLOSED_PR_SAMPLE,
                "release_sample": config.EVIDENCE_RELEASE_SAMPLE,
                "minimum_closed_pull_sample": config.EVIDENCE_MIN_CLOSED_PR_SAMPLE,
                "cache_ttl_hours": config.EVIDENCE_CACHE_TTL_HOURS,
                "partial_cache_ttl_hours": min(config.EVIDENCE_CACHE_TTL_HOURS, 1),
                "stale_hours": config.EVIDENCE_CACHE_STALE_HOURS,
            },
            "site_url": config.SITE_URL,
            **user_context(request, current_user),
        },
    )


def render_maintainer_landing(
    request: Request,
    current_user=None,
    error: Optional[str] = None,
    trial_blocked: bool = False,
    trial_block_reason: Optional[str] = None,
    status_code: int = 200,
):
    return templates.TemplateResponse(
        request=request,
        name="maintainer/landing.html",
        context={
            "error": error,
            "trial_blocked": trial_blocked,
            "trial_block_reason": trial_block_reason,
            **maintainer_template_context(request, current_user),
            **csrf_context(request),
        },
        status_code=status_code,
    )


@app.get("/maintainer", response_class=HTMLResponse)
def maintainer_landing(request: Request, source: str = ""):
    require_maintainer_enabled()
    current_user = get_current_user(request)
    if source == "radar":
        track_event(request, "radar_to_maintainer_clicked", user=current_user)
    track_event(request, "maintainer_page_viewed", user=current_user)
    return render_maintainer_landing(request, current_user)


@app.post("/maintainer/analyze", response_class=HTMLResponse)
def maintainer_analyze(
    request: Request,
    repo_url: str = Form(...),
    csrf_token: str = Form(""),
):
    require_maintainer_enabled()
    current_user = get_current_user(request)
    ip = request.client.host if request.client else "unknown"

    if not check_csrf(request, csrf_token):
        return render_maintainer_landing(
            request,
            current_user,
            error="Your session expired. Please try again.",
            status_code=400,
        )

    if current_user and not current_user.email_verified:
        request.session[POST_AUTH_NEXT_SESSION_KEY] = "/maintainer"
        return templates.TemplateResponse(
            request=request,
            name="verify_notice.html",
            context={
                "email": current_user.email,
                "message": "Please verify your email before creating a Maintainer report.",
                "next_path": "/maintainer",
                "login_url": auth_url("/login", "/maintainer"),
                **user_context(request, current_user),
                **csrf_context(request),
            },
            status_code=403,
        )

    if maintainer_trial_used(request, current_user, ip):
        track_event(
            request,
            "maintainer_trial_blocked",
            user=current_user,
            metadata={"access": maintainer_plan_context(current_user)},
        )
        return render_maintainer_landing(
            request,
            current_user,
            trial_blocked=True,
            status_code=429,
        )

    pending_repository = maintainer_pending_partial_repository(request, current_user)
    if pending_repository:
        try:
            owner, repository, _ = parse_repository_url(repo_url)
        except MaintainerServiceError as exc:
            return render_maintainer_landing(
                request,
                current_user,
                error=exc.public_message,
                status_code=400,
            )
        if f"{owner}/{repository}".casefold() != pending_repository:
            track_event(
                request,
                "maintainer_trial_blocked",
                user=current_user,
                metadata={"access": maintainer_plan_context(current_user), "reason": "pending_partial"},
            )
            return render_maintainer_landing(
                request,
                current_user,
                trial_blocked=True,
                trial_block_reason="pending_partial",
                status_code=429,
            )

    track_event(request, "maintainer_analysis_started", user=current_user, metadata={"repo_url": repo_url})
    try:
        outcome = build_maintainer_report(repo_url)
    except MaintainerServiceError as exc:
        track_event(
            request,
            "maintainer_analysis_failed",
            user=current_user,
            metadata={"error_code": exc.error_code},
        )
        return render_maintainer_landing(
            request,
            current_user,
            error=exc.public_message,
            status_code=400,
        )
    except Exception as exc:
        print(f"[/maintainer/analyze error] {exc!r}")
        track_event(
            request,
            "maintainer_analysis_failed",
            user=current_user,
            metadata={"error_code": "unexpected_error"},
        )
        return render_maintainer_landing(
            request,
            current_user,
            error="The report could not be completed. Please try again.",
            status_code=500,
        )

    report = MaintainerReport.model_validate(outcome["report"]).model_dump(mode="json")
    if outcome["is_partial"]:
        if not current_user:
            request.session["maintainer_trial_used"] = True
            report_notice = (
                "AI-assisted review was unavailable, so this deterministic partial report was generated. "
                "Your free Maintainer preview has been used. Create an account to continue evaluating "
                "repository issue queues."
            )
        elif has_maintainer_access(current_user):
            report_notice = "AI-assisted review was unavailable, so this deterministic partial report was generated."
        else:
            owner, repository, _ = parse_repository_url(repo_url)
            request.session[MAINTAINER_PENDING_PARTIAL_SESSION_KEY] = {
                "user_id": current_user.id,
                "repository": f"{owner}/{repository}".casefold(),
            }
            report_notice = (
                "The AI-assisted report was temporarily unavailable. You can retry this repository "
                "without using your complete-report trial."
            )
        track_event(
            request,
            "maintainer_analysis_failed",
            user=current_user,
            metadata={"error_code": outcome["error_code"], "partial": True},
        )
        return templates.TemplateResponse(
            request=request,
            name="maintainer/report.html",
            context={
                "report": report,
                "analysis": None,
                "report_notice": report_notice,
                "anonymous_preview_used": not current_user,
                **maintainer_template_context(request, current_user),
            },
        )

    db: Session = SessionLocal()
    try:
        analysis = MaintainerAnalysis(
            user_id=current_user.id if current_user else None,
            repository_full_name=report["repository"]["full_name"],
            repository_url=report["repository"]["url"],
            status="completed",
            analyzed_issue_count=report["issues_reviewed"],
            report_json=json.dumps(report, ensure_ascii=True),
            is_partial=False,
            error_code=None,
            plan_context=maintainer_plan_context(current_user),
            analysis_version=MAINTAINER_ANALYSIS_VERSION,
            ip_address=ip,
            completed_at=now_utc(),
        )
        db.add(analysis)
        db.commit()
        db.refresh(analysis)
        analysis_id = analysis.id
    except Exception as exc:
        db.rollback()
        print(f"[/maintainer/analyze persistence error] {exc!r}")
        track_event(
            request,
            "maintainer_analysis_failed",
            user=current_user,
            metadata={"error_code": "persistence_failed"},
        )
        return render_maintainer_landing(
            request,
            current_user,
            error="The report could not be saved, so your trial was not consumed. Please try again.",
            status_code=500,
        )
    finally:
        db.close()

    if not current_user:
        request.session["maintainer_trial_used"] = True
        report_notice = (
            "Your free Maintainer preview has been used. Create an account to continue evaluating "
            "repository issue queues."
        )
    else:
        pending = request.session.get(MAINTAINER_PENDING_PARTIAL_SESSION_KEY)
        if isinstance(pending, dict) and pending.get("user_id") == current_user.id:
            request.session.pop(MAINTAINER_PENDING_PARTIAL_SESSION_KEY, None)
        report_notice = None

    track_event(
        request,
        "maintainer_analysis_completed",
        user=current_user,
        metadata={"analysis_id": analysis_id, "repository": report["repository"]["full_name"]},
    )
    track_event(request, "maintainer_trial_completed", user=current_user, metadata={"analysis_id": analysis_id})

    if current_user:
        return RedirectResponse(url=f"/maintainer/report/{analysis_id}", status_code=303)
    return templates.TemplateResponse(
        request=request,
        name="maintainer/report.html",
        context={
            "report": report,
            "analysis": None,
            "report_notice": report_notice,
            "anonymous_preview_used": not current_user,
            **maintainer_template_context(request, current_user),
        },
    )


@app.get("/maintainer/report/{analysis_id}", response_class=HTMLResponse)
def maintainer_report(request: Request, analysis_id: int):
    require_maintainer_enabled()
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url="/login", status_code=303)

    db: Session = SessionLocal()
    try:
        analysis = db.query(MaintainerAnalysis).filter(
            MaintainerAnalysis.id == analysis_id,
            MaintainerAnalysis.user_id == current_user.id,
            MaintainerAnalysis.status == "completed",
            MaintainerAnalysis.is_partial.is_(False),
        ).first()
        if not analysis:
            raise HTTPException(status_code=404, detail="Report not found")
        report = MaintainerReport.model_validate_json(analysis.report_json).model_dump(mode="json")
    finally:
        db.close()

    track_event(request, "maintainer_report_viewed", user=current_user, metadata={"analysis_id": analysis_id})
    return templates.TemplateResponse(
        request=request,
        name="maintainer/report.html",
        context={
            "report": report,
            "analysis": analysis,
            "report_notice": None,
            "anonymous_preview_used": False,
            **maintainer_template_context(request, current_user),
        },
    )


@app.get("/maintainer/dashboard", response_class=HTMLResponse)
def maintainer_dashboard(request: Request):
    require_maintainer_enabled()
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url="/login", status_code=303)

    db: Session = SessionLocal()
    try:
        analyses = db.query(MaintainerAnalysis).filter(
            MaintainerAnalysis.user_id == current_user.id,
            MaintainerAnalysis.status == "completed",
            MaintainerAnalysis.is_partial.is_(False),
        ).order_by(MaintainerAnalysis.created_at.desc()).all()
        rows = []
        for analysis in analyses:
            try:
                report = MaintainerReport.model_validate_json(analysis.report_json)
            except Exception:
                continue
            rows.append({"analysis": analysis, "counts": report.counts.model_dump()})
    finally:
        db.close()

    return templates.TemplateResponse(
        request=request,
        name="maintainer/dashboard.html",
        context={
            "rows": rows,
            **maintainer_template_context(request, current_user),
            **csrf_context(request),
        },
    )


@app.get("/maintainer/pricing", response_class=HTMLResponse)
def maintainer_pricing(request: Request):
    require_maintainer_enabled()
    current_user = get_current_user(request)
    track_event(request, "maintainer_pilot_clicked", user=current_user)
    return templates.TemplateResponse(
        request=request,
        name="maintainer/pricing.html",
        context={"billing_error": None, **maintainer_template_context(request, current_user)},
    )


@app.get("/maintainer/billing/upgrade", response_class=HTMLResponse)
def maintainer_billing_upgrade(request: Request, billing_period: str = "monthly"):
    require_maintainer_enabled()
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(
            url=auth_url("/login", "/maintainer/billing/upgrade"),
            status_code=303,
        )
    if not current_user.email_verified:
        return templates.TemplateResponse(
            request=request,
            name="maintainer/pricing.html",
            context={
                "billing_error": "Verify your email before upgrading to Maintainer Pro.",
                **maintainer_template_context(request, current_user),
            },
            status_code=403,
        )
    if has_maintainer_access(current_user):
        return RedirectResponse(url="/maintainer/dashboard", status_code=303)
    billing_period = billing_period if billing_period in {"monthly", "annual"} else "monthly"
    paddle_price_id = pricing.price_id("maintainer", billing_period)
    if not config.PADDLE_CLIENT_TOKEN or not paddle_price_id:
        return templates.TemplateResponse(
            request=request,
            name="maintainer/pricing.html",
            context={
                "billing_error": "Billing temporarily unavailable. Please try again later.",
                **maintainer_template_context(request, current_user),
            },
            status_code=503,
        )

    track_event(request, "maintainer_checkout_started", user=current_user)
    return templates.TemplateResponse(
        request=request,
        name="maintainer/checkout.html",
        context={
            "paddle_client_token": config.PADDLE_CLIENT_TOKEN,
            "paddle_price_id": paddle_price_id,
            "paddle_env": config.PADDLE_ENV,
            "billing_period": billing_period,
            "user_email": current_user.email,
            "user_id": current_user.id,
            **maintainer_template_context(request, current_user),
        },
    )


@app.get("/maintainer/billing/success", response_class=HTMLResponse)
def maintainer_billing_success(request: Request):
    require_maintainer_enabled()
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(
            url=auth_url("/login", "/maintainer/billing/success"),
            status_code=303,
        )
    return templates.TemplateResponse(
        request=request,
        name="maintainer/billing_success.html",
        context={**maintainer_template_context(request, current_user)},
    )


@app.get("/maintainer/billing/manage", response_class=HTMLResponse)
def maintainer_billing_manage(request: Request):
    require_maintainer_enabled()
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(
            url=auth_url("/login", "/maintainer/billing/manage"),
            status_code=303,
        )
    if not current_user.paddle_customer_id:
        return templates.TemplateResponse(
            request=request,
            name="maintainer/billing_manage.html",
            context={
                "portal_error": "No Paddle billing profile is connected to this account yet.",
                **maintainer_template_context(request, current_user),
            },
        )

    try:
        portal_url = paddle_billing.create_customer_portal_url(current_user.paddle_customer_id)
    except (paddle_billing.PaddleBillingNotConfigured, paddle_billing.PaddlePortalError):
        return templates.TemplateResponse(
            request=request,
            name="maintainer/billing_manage.html",
            context={
                "portal_error": "The Paddle billing portal is temporarily unavailable. Please try again or contact support.",
                **maintainer_template_context(request, current_user),
            },
            status_code=503,
        )
    return RedirectResponse(url=portal_url, status_code=303)


@app.get("/tools/github-opportunity-score", response_class=HTMLResponse)
def github_opportunity_score_tool(request: Request):
    current_user = get_current_user(request)
    # Thin SEO/tool wrapper: the form posts to /analyze so all scoring,
    # limits, tracking writes, and result rendering stay in one place.
    track_event(request, "tool_view", user=current_user, metadata={"tool": "github_opportunity_score"})
    return templates.TemplateResponse(
        request=request,
        name="tool_github_opportunity_score.html",
        context={
            "site_url": config.SITE_URL,
            **pricing.template_context(),
            **user_context(request, current_user),
            **csrf_context(request),
        },
    )


@app.get("/tools/github-maintainer-workload-report", response_class=HTMLResponse)
def github_maintainer_workload_report_tool(request: Request):
    require_maintainer_enabled()
    current_user = get_current_user(request)
    # This acquisition page delegates to the existing Maintainer analysis route
    # so validation, quotas, AI fallback, persistence, and report rendering stay centralized.
    track_event(
        request,
        "tool_view",
        user=current_user,
        metadata={"tool": "github_maintainer_workload_report"},
    )
    return templates.TemplateResponse(
        request=request,
        name="tool_github_maintainer_workload_report.html",
        context={
            **maintainer_template_context(request, current_user),
            **csrf_context(request),
        },
    )


@app.post("/vscode-interest")
def vscode_interest(request: Request, csrf_token: str = Form("")):
    current_user = get_current_user(request)
    if not check_csrf(request, csrf_token):
        return RedirectResponse(url="/?vscode_interest=error#vscode-extension", status_code=303)
    if not current_user:
        return RedirectResponse(url="/register", status_code=303)

    track_event(request, "vscode_waitlist_clicked", user=current_user)
    if user_has_vscode_interest(current_user):
        return RedirectResponse(url="/?vscode_interest=already#vscode-extension", status_code=303)

    track_event(request, "vscode_interest_submitted", user=current_user)
    return RedirectResponse(url="/?vscode_interest=joined#vscode-extension", status_code=303)


@app.get("/tools/best-first-issue-finder", response_class=HTMLResponse)
def best_first_issue_finder_tool(request: Request):
    current_user = get_current_user(request)
    # Thin SEO/tool wrapper: the form posts to /analyze so the existing
    # analysis engine remains the single source for best issue selection.
    track_event(request, "tool_view", user=current_user, metadata={"tool": "best_first_issue_finder"})
    return templates.TemplateResponse(
        request=request,
        name="tool_best_first_issue_finder.html",
        context={
            "site_url": config.SITE_URL,
            **pricing.template_context(),
            **user_context(request, current_user),
            **csrf_context(request),
        },
    )


@app.get("/developer", response_class=HTMLResponse)
def developer_profile_landing(request: Request, source: str = ""):
    if source == "today":
        track_event(request, "opportunity_profile_cta_clicked", user=get_current_user(request))
    return render_developer_landing(request)


@app.post("/developer", response_class=HTMLResponse)
def developer_profile_generate(
    request: Request,
    github_username: str = Form(...),
    csrf_token: str = Form(""),
):
    current_user = get_current_user(request)
    if not check_csrf(request, csrf_token):
        return render_developer_landing(
            request,
            error="Your session expired. Please try again.",
            username=github_username,
            status_code=400,
        )
    try:
        normalized_username = normalize_github_username(github_username)
    except DeveloperProfileError as exc:
        return render_developer_landing(
            request,
            error=exc.message,
            username=github_username,
            status_code=400,
        )

    db: Session = SessionLocal()
    try:
        cached_profile = developer_profile_by_username(db, normalized_username)
        if cached_profile and developer_profile_is_fresh(cached_profile):
            track_event(request, "developer_profile_cache_hit", user=current_user)
            return RedirectResponse(url=f"/developer/{cached_profile.public_slug}", status_code=303)
    finally:
        db.close()

    if not current_user and not consume_anonymous_developer_generation(request):
        return render_developer_landing(
            request,
            error="Profile generation limit reached. Please create an account or try again later.",
            username=normalized_username,
            status_code=429,
        )

    track_event(request, "developer_profile_started", user=current_user)
    try:
        analysis = analyze_developer_profile(normalized_username)
    except DeveloperProfileError as exc:
        track_event(request, "developer_profile_failed", user=current_user, metadata={"reason": exc.code})
        db = SessionLocal()
        try:
            stale_profile = developer_profile_by_username(db, normalized_username)
            if stale_profile:
                request.session["developer_profile_notice"] = (
                    "GitHub could not refresh this profile. The previous public snapshot is still available."
                )
                return RedirectResponse(url=f"/developer/{stale_profile.public_slug}", status_code=303)
        finally:
            db.close()
        status_code = {
            "invalid_username": 400,
            "github_user_not_found": 404,
            "github_organization": 400,
            "github_rate_limit": 429,
        }.get(exc.code, 503)
        return render_developer_landing(
            request,
            error=exc.message,
            username=normalized_username,
            status_code=status_code,
        )

    db = SessionLocal()
    try:
        profile = db.query(DeveloperProfile).filter(DeveloperProfile.github_user_id == analysis["github_user_id"]).first()
        username_profile = developer_profile_by_username(db, analysis["github_username"])
        if username_profile and username_profile is not profile:
            if username_profile.is_claimed:
                return render_developer_landing(
                    request,
                    error="This GitHub username changed recently. The profile cannot be replaced automatically.",
                    username=normalized_username,
                    status_code=409,
                )
            db.delete(username_profile)
            db.flush()
        if profile is None:
            profile = DeveloperProfile()
            db.add(profile)
        apply_developer_profile_analysis(profile, analysis)
        db.commit()
        db.refresh(profile)
        profile_slug = profile.public_slug
    except IntegrityError:
        db.rollback()
        return render_developer_landing(
            request,
            error="This GitHub profile changed while it was being analyzed. Please try again.",
            username=normalized_username,
            status_code=409,
        )
    finally:
        db.close()

    track_event(request, "developer_profile_generated", user=current_user)
    return RedirectResponse(url=f"/developer/{profile_slug}", status_code=303)


@app.get("/developer/{github_username}", response_class=HTMLResponse)
def developer_profile_view(request: Request, github_username: str):
    try:
        normalized_username = normalize_github_username(github_username)
    except DeveloperProfileError:
        return render_developer_landing(request, error="That developer profile was not found.", status_code=404)

    current_user = get_current_user(request)
    db: Session = SessionLocal()
    try:
        profile = developer_profile_by_username(db, normalized_username)
        if not profile:
            return render_developer_landing(
                request,
                error="That profile has not been generated yet.",
                username=normalized_username,
                status_code=404,
            )
        is_owner = developer_profile_is_owner(profile, current_user)
        can_claim = developer_profile_can_be_claimed(profile, current_user)
        is_indexable = bool(profile.is_claimed and profile.is_public)
        pro_view = bool(is_owner and has_pro_access(current_user))
        contribution_limit = 30 if pro_view else 12
        contribution_data = list(profile.contribution_data or [])
        profile_context = {
            "profile": profile,
            "activity": profile.profile_data or {},
            "strengths": profile.strength_data or {},
            "contributions": contribution_data[:contribution_limit],
            "timeline": contribution_data[: 20 if pro_view else 8],
            "is_owner": is_owner,
            "can_claim": can_claim,
            "is_indexable": is_indexable,
            "is_pro_view": pro_view,
            "profile_public_url": f"{config.SITE_URL.rstrip('/')}/developer/{profile.public_slug}",
            "profile_card_url": f"{config.SITE_URL.rstrip('/')}/developer/{profile.public_slug}/card",
            "profile_recommendation_card_url": f"{config.SITE_URL.rstrip('/')}/developer/{profile.public_slug}/recommendation-card",
            "notice": request.session.pop("developer_profile_notice", ""),
            "site_url": config.SITE_URL,
            "opportunity_recommendations": ranked_recommendations(
                load_feed_items(db),
                profile,
                limit=3,
            ),
        }
        profile_context["linkedin_share_url"] = "https://www.linkedin.com/sharing/share-offsite/?" + urlencode(
            {"url": profile_context["profile_public_url"]}
        )
        profile_context["x_share_url"] = "https://twitter.com/intent/tweet?" + urlencode(
            {
                "url": profile_context["profile_public_url"],
                "text": "My public GitHub proof-of-work profile, generated with BashOps Radar.",
            }
        )
    finally:
        db.close()

    return templates.TemplateResponse(
        request=request,
        name="developer_profile.html",
        context={
            **profile_context,
            **user_context(request, current_user),
            **csrf_context(request),
        },
    )


def _svg_card_response(content: str, filename: str, download: bool) -> Response:
    headers = {"Cache-Control": "public, max-age=900"}
    if download:
        headers["Content-Disposition"] = f'attachment; filename="{filename}"'
    return Response(content=content, media_type="image/svg+xml", headers=headers)


@app.get("/developer/{github_username}/card")
def developer_profile_card(request: Request, github_username: str, download: bool = False):
    try:
        normalized_username = normalize_github_username(github_username)
    except DeveloperProfileError:
        raise HTTPException(status_code=404, detail="Developer profile not found.")
    db: Session = SessionLocal()
    try:
        profile = developer_profile_by_username(db, normalized_username)
        if not profile or not profile.is_claimed or not profile.is_public:
            raise HTTPException(status_code=404, detail="Developer profile not found.")
        card = render_developer_profile_card(profile)
        filename = f"bashops-{profile.public_slug}-profile.svg"
    finally:
        db.close()
    track_event(request, "share_download" if download else "share_card_generated", user=get_current_user(request))
    return _svg_card_response(card, filename, download)


@app.get("/developer/{github_username}/recommendation-card")
def developer_profile_recommendation_card(request: Request, github_username: str, download: bool = False):
    try:
        normalized_username = normalize_github_username(github_username)
    except DeveloperProfileError:
        raise HTTPException(status_code=404, detail="Developer profile not found.")
    db: Session = SessionLocal()
    try:
        profile = developer_profile_by_username(db, normalized_username)
        if not profile or not profile.is_claimed or not profile.is_public:
            raise HTTPException(status_code=404, detail="Developer profile not found.")
        recommendations = ranked_recommendations(load_feed_items(db), profile, limit=1)
        if not recommendations:
            raise HTTPException(status_code=404, detail="No cached recommendation is available.")
        recommendation = recommendations[0]
        item = recommendation["item"]
        card = render_opportunity_card(
            item,
            contract_potential=contract_potential(int(round(item.radar_score))),
            heading="Your Next OSS Opportunity",
            reason=" | ".join(recommendation.get("match_reasons") or [item.public_reason]),
            destination=f"bashops.site/developer/{profile.public_slug}",
        )
        filename = f"bashops-{profile.public_slug}-recommendation.svg"
    finally:
        db.close()
    track_event(request, "share_download" if download else "share_card_generated", user=get_current_user(request))
    return _svg_card_response(card, filename, download)


def _developer_profile_action_context(request: Request, github_username: str, csrf_token: str):
    current_user = get_current_user(request)
    if not current_user:
        return None, None, RedirectResponse(
            url=auth_url("/login", f"/developer/{github_username}"),
            status_code=303,
        )
    if not check_csrf(request, csrf_token):
        return None, None, HTMLResponse("Your session expired. Please try again.", status_code=403)
    db: Session = SessionLocal()
    profile = developer_profile_by_username(db, github_username)
    if not profile:
        db.close()
        return None, None, HTMLResponse("Developer profile not found.", status_code=404)
    return current_user, (db, profile), None


@app.post("/developer/{github_username}/claim")
def developer_profile_claim(request: Request, github_username: str, csrf_token: str = Form("")):
    current_user, profile_state, response = _developer_profile_action_context(request, github_username, csrf_token)
    if response:
        return response
    db, profile = profile_state
    profile_slug = profile.public_slug
    try:
        if not developer_profile_can_be_claimed(profile, current_user):
            return HTMLResponse("Profile ownership could not be verified through GitHub.", status_code=403)
        profile.user_id = current_user.id
        profile.is_claimed = True
        profile.is_public = False
        db.commit()
    except IntegrityError:
        db.rollback()
        return HTMLResponse("This BashOps account already owns a developer profile.", status_code=409)
    finally:
        db.close()
    track_event(request, "developer_profile_claimed", user=current_user)
    return RedirectResponse(url=f"/developer/{profile_slug}", status_code=303)


def _set_developer_profile_publication(request: Request, github_username: str, csrf_token: str, is_public: bool):
    current_user, profile_state, response = _developer_profile_action_context(request, github_username, csrf_token)
    if response:
        return response
    db, profile = profile_state
    profile_slug = profile.public_slug
    try:
        if not developer_profile_is_owner(profile, current_user):
            return HTMLResponse("Only the verified profile owner can change publication.", status_code=403)
        profile.is_public = is_public
        db.commit()
    finally:
        db.close()
    track_event(
        request,
        "developer_profile_published" if is_public else "developer_profile_unpublished",
        user=current_user,
    )
    return RedirectResponse(url=f"/developer/{profile_slug}", status_code=303)


@app.post("/developer/{github_username}/publish")
def developer_profile_publish(request: Request, github_username: str, csrf_token: str = Form("")):
    return _set_developer_profile_publication(request, github_username, csrf_token, True)


@app.post("/developer/{github_username}/unpublish")
def developer_profile_unpublish(request: Request, github_username: str, csrf_token: str = Form("")):
    return _set_developer_profile_publication(request, github_username, csrf_token, False)


@app.post("/developer/{github_username}/refresh")
def developer_profile_refresh(request: Request, github_username: str, csrf_token: str = Form("")):
    current_user, profile_state, response = _developer_profile_action_context(request, github_username, csrf_token)
    if response:
        return response
    db, profile = profile_state
    profile_id = profile.id
    profile_slug = profile.public_slug
    lookup_username = current_user.github_username or profile.github_username
    analyzed_at = _aware_utc(profile.analyzed_at)
    if not developer_profile_is_owner(profile, current_user):
        db.close()
        return HTMLResponse("Only the verified profile owner can refresh this profile.", status_code=403)
    if analyzed_at and analyzed_at > now_utc() - timedelta(hours=OWNER_REFRESH_HOURS):
        db.close()
        request.session["developer_profile_notice"] = (
            f"This profile was refreshed recently. Owner refresh is available every {OWNER_REFRESH_HOURS} hours."
        )
        return RedirectResponse(url=f"/developer/{profile_slug}", status_code=303)
    db.close()

    try:
        analysis = analyze_developer_profile(lookup_username)
    except DeveloperProfileError as exc:
        request.session["developer_profile_notice"] = (
            "GitHub could not refresh this profile. The existing public snapshot was preserved."
        )
        track_event(request, "developer_profile_failed", user=current_user, metadata={"reason": exc.code})
        return RedirectResponse(url=f"/developer/{profile_slug}", status_code=303)

    db = SessionLocal()
    refresh_succeeded = False
    try:
        profile = db.query(DeveloperProfile).filter(DeveloperProfile.id == profile_id).first()
        if not profile or not developer_profile_is_owner(profile, current_user):
            return HTMLResponse("Developer profile not found.", status_code=404)
        apply_developer_profile_analysis(profile, analysis)
        db.commit()
        profile_slug = profile.public_slug
        refresh_succeeded = True
    except IntegrityError:
        db.rollback()
        request.session["developer_profile_notice"] = "The refreshed GitHub username conflicts with another profile."
    finally:
        db.close()
    if refresh_succeeded:
        track_event(request, "developer_profile_refreshed", user=current_user)
    return RedirectResponse(url=f"/developer/{profile_slug}", status_code=303)


@app.post("/developer/{github_username}/delete")
def developer_profile_delete(request: Request, github_username: str, csrf_token: str = Form("")):
    current_user, profile_state, response = _developer_profile_action_context(request, github_username, csrf_token)
    if response:
        return response
    db, profile = profile_state
    try:
        if not developer_profile_is_owner(profile, current_user):
            return HTMLResponse("Only the verified profile owner can delete this profile.", status_code=403)
        db.delete(profile)
        db.commit()
    finally:
        db.close()
    track_event(request, "developer_profile_deleted", user=current_user)
    return RedirectResponse(url="/developer", status_code=303)


@app.post("/developer/{github_username}/event")
def developer_profile_event(
    request: Request,
    github_username: str,
    action: str = Form(...),
    csrf_token: str = Form(""),
):
    if not check_csrf(request, csrf_token):
        return JSONResponse({"error": "invalid session"}, status_code=403)
    allowed_events = {
        "linkedin": "developer_profile_shared_linkedin",
        "x": "developer_profile_shared_x",
        "link_copied": "developer_profile_link_copied",
        "portfolio_copied": "developer_portfolio_summary_copied",
        "opportunity_clicked": "developer_profile_opportunity_clicked",
        "upgrade_clicked": "developer_profile_upgrade_clicked",
    }
    event_name = allowed_events.get(action)
    if not event_name:
        return JSONResponse({"error": "invalid action"}, status_code=400)
    db: Session = SessionLocal()
    try:
        if not developer_profile_by_username(db, github_username):
            return JSONResponse({"error": "profile not found"}, status_code=404)
    finally:
        db.close()
    track_event(request, event_name, user=get_current_user(request))
    return JSONResponse({"ok": True})


def _opportunity_refresh_status():
    try:
        return refresh_opportunity_feed(force=False)
    except Exception:
        return {"status": "unavailable", "updated": 0, "failed": 0}


@app.get("/today", response_class=HTMLResponse)
def public_opportunities_today(request: Request, source: str = ""):
    current_user = get_current_user(request)
    if source == "extension":
        track_event(request, "extension_open_radar", user=current_user)
    refresh_status = _opportunity_refresh_status()
    db: Session = SessionLocal()
    try:
        items = load_feed_items(db)
        recommendations = ranked_recommendations(items, limit=PUBLIC_RECOMMENDATION_LIMIT)
        freshness = feed_freshness(items)
    finally:
        db.close()

    languages = sorted(
        {value["item"].primary_language for value in recommendations if value["item"].primary_language}
    )
    summary = {
        "opportunity_count": len(recommendations),
        "language_count": len(languages),
        "active_maintenance_count": sum(
            "High" in (value["item"].maintainer_activity_signal or "")
            for value in recommendations
        ),
        "beginner_friendly_count": sum(
            "Good First Issue" in (value["item"].categories or [])
            for value in recommendations
        ),
        "commercial_signal_count": sum(
            (value["item"].paid_sprint_signal or "").startswith("Potential")
            for value in recommendations
        ),
    }
    track_event(request, "public_today_viewed", user=current_user, metadata={"result_count": len(recommendations)})
    return templates.TemplateResponse(
        request=request,
        name="today.html",
        context={
            "recommendations": recommendations,
            "summary": summary,
            "languages": languages,
            "freshness": freshness,
            "refresh_status": refresh_status["status"],
            "today": now_utc().date(),
            "site_url": config.SITE_URL,
            "today_card_url": f"{config.SITE_URL.rstrip('/')}/today/card",
            "today_linkedin_share_url": "https://www.linkedin.com/sharing/share-offsite/?" + urlencode(
                {"url": f"{config.SITE_URL.rstrip('/')}/today"}
            ),
            "today_x_share_url": "https://twitter.com/intent/tweet?" + urlencode(
                {
                    "url": f"{config.SITE_URL.rstrip('/')}/today",
                    "text": "Today's evidence-backed open-source opportunities from BashOps Radar.",
                }
            ),
            **user_context(request, current_user),
            **csrf_context(request),
        },
    )


@app.get("/today/card")
def public_opportunities_today_card(request: Request, download: bool = False):
    db: Session = SessionLocal()
    try:
        recommendations = ranked_recommendations(load_feed_items(db), limit=1)
        if not recommendations:
            raise HTTPException(status_code=404, detail="No cached opportunity is available.")
        item = recommendations[0]["item"]
        card = render_opportunity_card(
            item,
            contract_potential=contract_potential(int(round(item.radar_score))),
            potential_label="Paid Sprint Potential",
            destination="bashops.site/today",
        )
    finally:
        db.close()
    track_event(request, "share_download" if download else "share_card_generated", user=get_current_user(request))
    return _svg_card_response(card, "bashops-today-opportunity.svg", download)


@app.get("/api/public/repository-summary")
def public_repository_summary(request: Request, owner: str, repo: str):
    track_event(request, "extension_open", user=get_current_user(request))
    try:
        full_name = normalize_repository_full_name(f"{owner}/{repo}")
    except OpportunityFeedError:
        return JSONResponse({"available": False, "error": "invalid repository"}, status_code=400)
    track_event(request, "extension_repository", user=get_current_user(request), metadata={"repository": full_name})
    db: Session = SessionLocal()
    try:
        item = (
            db.query(OpportunityFeedItem)
            .filter(
                OpportunityFeedItem.is_active.is_(True),
                func.lower(OpportunityFeedItem.repository_full_name) == full_name.casefold(),
            )
            .first()
        )
        if not item:
            analyze_url = f"{config.SITE_URL.rstrip('/')}/?" + urlencode(
                {"source": "extension-analyze", "repo_url": f"https://github.com/{full_name}"}
            )
            return JSONResponse(
                {"available": False, "repository": full_name, "analyze_url": analyze_url},
                status_code=404,
                headers={"Cache-Control": "public, max-age=60"},
            )
        payload = public_opportunity_payload(item)
    finally:
        db.close()
    payload.update(
        {
            "available": True,
            "open_radar_url": f"{config.SITE_URL.rstrip('/')}/today?source=extension",
            "analyze_url": f"{config.SITE_URL.rstrip('/')}/?" + urlencode(
                {"source": "extension-analyze", "repo_url": f"https://github.com/{full_name}"}
            ),
        }
    )
    return JSONResponse(payload, headers={"Cache-Control": "public, max-age=300"})


@app.get("/jobs", response_class=HTMLResponse)
def public_oss_opportunities(request: Request):
    current_user = get_current_user(request)
    refresh_status = _opportunity_refresh_status()
    db: Session = SessionLocal()
    feed_error = ""
    try:
        try:
            items = load_feed_items(db)
        except SQLAlchemyError:
            db.rollback()
            items = []
            feed_error = "The public opportunity feed is temporarily unavailable. You can still analyze a repository directly."
        sections = []
        for section in curated_opportunity_sections(items):
            section_items = []
            for position, item in enumerate(section["items"], start=1):
                payload = public_opportunity_payload(item)
                ranking = section["ranking_details"].get(item.repository_full_name.casefold(), {})
                payload.update({**ranking, "position": position})
                section_items.append(payload)
            sections.append(
                {
                    "key": section["key"],
                    "title": section["title"],
                    "description": section["description"],
                    "items": section_items,
                }
            )
        freshness = feed_freshness(items)
    finally:
        db.close()
    result_count = len({item["repository"] for section in sections for item in section["items"]})
    track_event(
        request,
        "jobs_page_viewed",
        user=current_user,
        metadata={"result_count": result_count, "authenticated": bool(current_user)},
    )
    unique_items = {}
    for section in sections:
        for item in section["items"]:
            unique_items.setdefault(item["repository"].casefold(), item)
    jobs_json_ld = {
        "@context": "https://schema.org",
        "@type": "ItemList",
        "name": "Today's Open Source Opportunities",
        "description": "Evidence-backed GitHub repositories for proof-of-work, paid sprint, and founder conversation research.",
        "numberOfItems": result_count,
        "itemListElement": [
            {
                "@type": "ListItem",
                "position": index,
                "name": item["repository"],
                "url": item["repository_url"],
            }
            for index, item in enumerate(
                unique_items.values(),
                start=1,
            )
        ],
    }
    return templates.TemplateResponse(
        request=request,
        name="jobs.html",
        context={
            "sections": sections,
            "freshness": freshness,
            "refresh_status": refresh_status["status"],
            "result_count": result_count,
            "feed_error": feed_error,
            "jobs_json_ld": jobs_json_ld,
            "site_url": config.SITE_URL,
            **user_context(request, current_user),
            **csrf_context(request),
        },
    )


@app.post("/public/event")
def public_distribution_event(
    request: Request,
    action: str = Form(...),
    surface: str = Form(""),
    detail: str = Form(""),
    category: str = Form(""),
    repository: str = Form(""),
    position: int = Form(0),
    csrf_token: str = Form(""),
):
    if not check_csrf(request, csrf_token):
        return JSONResponse({"error": "invalid session"}, status_code=403)
    current_user = get_current_user(request)
    allowed_events = {
        "share_linkedin": "share_linkedin",
        "share_x": "share_x",
        "share_copy": "share_copy",
        "jobs_category": "jobs_category",
        "jobs_repository": "jobs_repository",
        "jobs_analyze": "jobs_analyze",
        "jobs_profile": "jobs_profile",
        "jobs_category_viewed": "jobs_category_viewed",
        "jobs_category_selected": "jobs_category_selected",
        "jobs_repository_card_viewed": "jobs_repository_card_viewed",
        "jobs_repository_clicked": "jobs_repository_clicked",
        "jobs_why_ranked_expanded": "jobs_why_ranked_expanded",
        "jobs_analysis_started": "jobs_analysis_started",
        "jobs_issue_opened": "jobs_issue_opened",
    }
    event_name = allowed_events.get(action)
    if not event_name or surface not in {"profile", "today", "jobs"}:
        return JSONResponse({"error": "invalid action"}, status_code=400)
    safe_detail = detail[:100] if re.fullmatch(r"[A-Za-z0-9_. /-]{0,100}", detail or "") else ""
    safe_category = category[:64] if re.fullmatch(r"[a-z0-9-]{0,64}", category or "") else ""
    try:
        safe_repository = normalize_repository_full_name(repository) if repository else ""
    except OpportunityFeedError:
        safe_repository = ""
    safe_position = max(0, min(int(position or 0), 100))
    track_event(
        request,
        event_name,
        user=current_user,
        metadata={
            "surface": surface,
            "detail": safe_detail,
            "category": safe_category,
            "repository": safe_repository,
            "position": safe_position,
            "authenticated": bool(current_user),
        },
    )
    return JSONResponse({"ok": True})


@app.get("/dashboard/opportunities", response_class=HTMLResponse)
def opportunity_dashboard(request: Request, refresh: str = ""):
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url=auth_url("/login", "/dashboard/opportunities"), status_code=303)

    refresh_status = _opportunity_refresh_status()
    db: Session = SessionLocal()
    try:
        profile = db.query(DeveloperProfile).filter(DeveloperProfile.user_id == current_user.id).first()
        items = load_feed_items(db)
        dismissed = interaction_ids(
            db,
            current_user.id,
            "dismissed",
            since=now_utc() - timedelta(days=DISMISS_COOLDOWN_DAYS),
        )
        limit = PRO_RECOMMENDATION_LIMIT if has_pro_access(current_user) else FREE_RECOMMENDATION_LIMIT
        recommendations = ranked_recommendations(items, profile, limit=limit, dismissed_ids=dismissed)
        saved = saved_items(db, current_user.id, limit=limit)
        recently_viewed = recently_viewed_items(db, current_user.id)
        freshness = feed_freshness(items)
    finally:
        db.close()

    previous_visit = request.session.get("opportunity_dashboard_last_visit")
    previous_visit_at = None
    try:
        previous_visit_at = datetime.fromisoformat(previous_visit) if previous_visit else None
        if previous_visit_at and previous_visit_at.tzinfo is None:
            previous_visit_at = previous_visit_at.replace(tzinfo=timezone.utc)
    except (TypeError, ValueError):
        previous_visit_at = None
    new_since_visit = [
        value for value in recommendations
        if previous_visit_at is None or _aware_utc(value["item"].first_seen_at) > previous_visit_at
    ]
    request.session["opportunity_dashboard_last_visit"] = now_utc().isoformat()
    notice = request.session.pop("opportunity_dashboard_notice", "")
    track_event(
        request,
        "opportunity_dashboard_viewed",
        user=current_user,
        metadata={"result_count": len(recommendations), "personalized": bool(profile)},
    )
    return templates.TemplateResponse(
        request=request,
        name="opportunity_dashboard.html",
        context={
            "recommendations": recommendations,
            "new_since_visit": new_since_visit[:5],
            "saved_items": saved,
            "recently_viewed": recently_viewed,
            "profile": profile,
            "freshness": freshness,
            "refresh_status": refresh or refresh_status["status"],
            "notice": notice,
            "recommendation_limit": limit,
            **user_context(request, current_user),
            **csrf_context(request),
        },
    )


def _opportunity_action_context(request: Request, item_id: int, csrf_token: str):
    current_user = get_current_user(request)
    if not current_user:
        return None, None, RedirectResponse(url=auth_url("/login", "/dashboard/opportunities"), status_code=303)
    if not check_csrf(request, csrf_token):
        return None, None, HTMLResponse("Your session expired. Please try again.", status_code=403)
    db: Session = SessionLocal()
    item = db.query(OpportunityFeedItem).filter(OpportunityFeedItem.id == item_id).first()
    if not item:
        db.close()
        return None, None, HTMLResponse("That opportunity is no longer available.", status_code=404)
    return current_user, (db, item), None


@app.post("/dashboard/opportunities/{item_id}/save")
def opportunity_save(request: Request, item_id: int, csrf_token: str = Form("")):
    current_user, state, response = _opportunity_action_context(request, item_id, csrf_token)
    if response:
        return response
    db, item = state
    try:
        if not can_save_more(db, current_user.id, has_pro_access(current_user)):
            request.session["opportunity_dashboard_notice"] = "Your saved opportunity limit is reached."
        else:
            upsert_interaction(db, current_user.id, item.id, "saved")
            track_event(request, "opportunity_saved", user=current_user, metadata={"item_id": item.id})
    finally:
        db.close()
    return RedirectResponse(url="/dashboard/opportunities", status_code=303)


@app.post("/dashboard/opportunities/{item_id}/dismiss")
def opportunity_dismiss(request: Request, item_id: int, csrf_token: str = Form("")):
    current_user, state, response = _opportunity_action_context(request, item_id, csrf_token)
    if response:
        return response
    db, item = state
    try:
        upsert_interaction(db, current_user.id, item.id, "dismissed")
        track_event(request, "opportunity_dismissed", user=current_user, metadata={"item_id": item.id})
    finally:
        db.close()
    return RedirectResponse(url="/dashboard/opportunities", status_code=303)


@app.post("/dashboard/opportunities/{item_id}/view")
def opportunity_view(
    request: Request,
    item_id: int,
    action: str = Form("viewed"),
    csrf_token: str = Form(""),
):
    current_user, state, response = _opportunity_action_context(request, item_id, csrf_token)
    if response:
        return response
    action_events = {
        "viewed": "opportunity_item_viewed",
        "repository_opened": "opportunity_repository_opened",
        "issue_opened": "opportunity_issue_opened",
        "analyzed": "opportunity_analyze_clicked",
    }
    event_name = action_events.get(action)
    if not event_name:
        state[0].close()
        return JSONResponse({"error": "invalid action"}, status_code=400)
    db, item = state
    try:
        upsert_interaction(db, current_user.id, item.id, action)
        track_event(request, event_name, user=current_user, metadata={"item_id": item.id})
    finally:
        db.close()
    return JSONResponse({"ok": True})


@app.post("/dashboard/opportunities/refresh")
def opportunity_refresh(request: Request, csrf_token: str = Form("")):
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url=auth_url("/login", "/dashboard/opportunities"), status_code=303)
    if not check_csrf(request, csrf_token):
        return HTMLResponse("Your session expired. Please try again.", status_code=403)
    cooldown_hours = 6 if has_pro_access(current_user) else 24
    last_refresh = request.session.get("opportunity_refresh_requested_at")
    try:
        last_refresh_at = datetime.fromisoformat(last_refresh) if last_refresh else None
        if last_refresh_at and last_refresh_at.tzinfo is None:
            last_refresh_at = last_refresh_at.replace(tzinfo=timezone.utc)
    except (TypeError, ValueError):
        last_refresh_at = None
    if last_refresh_at and last_refresh_at > now_utc() - timedelta(hours=cooldown_hours):
        request.session["opportunity_dashboard_notice"] = (
            f"A manual refresh is available every {cooldown_hours} hours on your current plan."
        )
        return RedirectResponse(url="/dashboard/opportunities?refresh=rate_limited", status_code=303)

    request.session["opportunity_refresh_requested_at"] = now_utc().isoformat()
    track_event(request, "opportunity_refresh_requested", user=current_user)
    try:
        result = refresh_opportunity_feed(force=True)
    except Exception:
        result = {"status": "unavailable", "updated": 0, "failed": 0}
    event_name = "opportunity_refresh_completed" if result["status"] == "refreshed" else "opportunity_refresh_failed"
    track_event(
        request,
        event_name,
        user=current_user,
        metadata={"status": result["status"], "updated": result["updated"]},
    )
    return RedirectResponse(url=f"/dashboard/opportunities?refresh={result['status']}", status_code=303)


@app.get("/discover", response_class=HTMLResponse)
def discover(request: Request):
    current_user = get_current_user(request)
    can_run_discovery = has_pro_access(current_user)
    track_event(
        request,
        "discover_view",
        user=current_user,
        metadata={"access": "pro" if can_run_discovery else "free"},
    )
    categories = category_options()
    return templates.TemplateResponse(
        request=request,
        name="discover.html",
        context={
            "categories": categories,
            "selected_category": categories[0]["value"],
            "results": [],
            "error": None,
            "can_run_discovery": can_run_discovery,
            "site_url": config.SITE_URL,
            **user_context(request, current_user),
            **csrf_context(request),
        },
    )


@app.post("/discover", response_class=HTMLResponse)
def discover_submit(
    request: Request,
    category: str = Form("python-fastapi"),
    csrf_token: str = Form(""),
):
    current_user = get_current_user(request)
    can_run_discovery = has_pro_access(current_user)
    categories = category_options()
    category_values = {item["value"] for item in categories}
    selected_category = category if category in category_values else categories[0]["value"]
    results = []
    error = None

    if not check_csrf(request, csrf_token):
        error = "Your session expired. Please try again."
    elif not can_run_discovery:
        error = "Upgrade to Pro to run Opportunity Finder."
    else:
        try:
            payload = discover_opportunities(selected_category, limit=8)
            results = payload["results"]
            track_event(
                request,
                "discover_run",
                user=current_user,
                metadata={"category": selected_category, "result_count": len(results)},
            )
            if not results:
                error = "No strong matches found for that category yet. Try another category."
        except DiscoveryError as exc:
            error = str(exc)
        except Exception as exc:
            print(f"[/discover error] {exc!r}")
            error = "Opportunity Finder is temporarily unavailable. Please try again."

    return templates.TemplateResponse(
        request=request,
        name="discover.html",
        context={
            "categories": categories,
            "selected_category": selected_category,
            "results": results,
            "error": error,
            "can_run_discovery": can_run_discovery,
            "site_url": config.SITE_URL,
            **user_context(request, current_user),
            **csrf_context(request),
        },
    )


@app.get("/terms", response_class=HTMLResponse)
def terms(request: Request):
    return templates.TemplateResponse(
        request=request,
        name="terms.html",
        context={**user_context(request), "site_url": config.SITE_URL},
    )


@app.get("/privacy", response_class=HTMLResponse)
def privacy(request: Request):
    return templates.TemplateResponse(
        request=request,
        name="privacy.html",
        context={**user_context(request), "site_url": config.SITE_URL},
    )


@app.get("/refund", response_class=HTMLResponse)
def refund(request: Request):
    return templates.TemplateResponse(
        request=request,
        name="refund.html",
        context={**user_context(request), "site_url": config.SITE_URL},
    )


@app.get("/contact", response_class=HTMLResponse)
def contact(request: Request):
    return templates.TemplateResponse(
        request=request,
        name="contact.html",
        context={**user_context(request), "site_url": config.SITE_URL},
    )


@app.get("/login", response_class=HTMLResponse)
def login(
    request: Request,
    joined: bool = False,
    registered: bool = False,
    verified: bool = False,
    reset: bool = False,
    next: str = "",
):
    next_path = safe_next_path(next or request.session.get(POST_AUTH_NEXT_SESSION_KEY, ""))
    return render_login(
        request,
        joined=joined,
        registered=registered,
        verified=verified,
        reset=reset,
        next_path=next_path,
    )


@app.post("/login")
def login_user(
    request: Request,
    email: str = Form(...),
    password: str = Form(...),
    csrf_token: str = Form(""),
    next: str = Form(""),
):
    next_path = safe_next_path(next or request.session.get(POST_AUTH_NEXT_SESSION_KEY, ""))
    if not check_csrf(request, csrf_token):
        return render_login(request, error="Your session expired. Please try again.", next_path=next_path)

    db: Session = SessionLocal()
    try:
        normalized_email = email.strip().lower()
        user = user_by_email(db, normalized_email)

        if not user or not user.password_hash or not verify_password(password, user.password_hash):
            return render_login(request, error="Invalid email or password.", next_path=next_path)

        if not user.email_verified:
            request.session[POST_AUTH_NEXT_SESSION_KEY] = next_path
            return render_login(
                request,
                error="Please verify your email before logging in.",
                next_path=next_path,
            )

        request.session["user_id"] = user.id
        request.session.pop(POST_AUTH_NEXT_SESSION_KEY, None)
        track_event(request, "login_success", user=user)
    finally:
        db.close()

    return RedirectResponse(url=next_path, status_code=303)


@app.get("/logout")
def logout(request: Request):
    request.session.clear()
    return RedirectResponse(url="/login", status_code=303)


@app.get("/auth/github/login")
def github_login(request: Request, next: str = ""):
    next_path = safe_next_path(next or request.session.get(POST_AUTH_NEXT_SESSION_KEY, ""))
    if not config.github_oauth_configured:
        return render_login(
            request,
            error="GitHub login is not configured yet.",
            next_path=next_path,
        )

    state = new_token()
    request.session["github_oauth_state"] = state
    request.session[GITHUB_OAUTH_NEXT_SESSION_KEY] = next_path
    params = {
        "client_id": config.GITHUB_CLIENT_ID,
        "redirect_uri": config.GITHUB_OAUTH_REDIRECT_URI,
        "scope": "read:user user:email",
        "state": state,
        "allow_signup": "true",
    }
    return RedirectResponse(
        url=f"https://github.com/login/oauth/authorize?{urlencode(params)}",
        status_code=303,
    )


@app.get("/auth/github/callback", response_class=HTMLResponse)
def github_callback(request: Request, code: str = "", state: str = "", error: str = ""):
    next_path = safe_next_path(request.session.pop(GITHUB_OAUTH_NEXT_SESSION_KEY, ""))
    if error:
        request.session.pop("github_oauth_state", None)
        return render_login(
            request,
            error="GitHub login was cancelled or failed.",
            next_path=next_path,
        )

    expected_state = request.session.pop("github_oauth_state", None)
    if not expected_state or not state or not secrets.compare_digest(expected_state, state):
        return render_login(
            request,
            error="GitHub login session expired. Please try again.",
            next_path=next_path,
        )

    if not config.github_oauth_configured:
        return render_login(
            request,
            error="GitHub login is not configured yet.",
            next_path=next_path,
        )

    try:
        token_response = requests.post(
            "https://github.com/login/oauth/access_token",
            data={
                "client_id": config.GITHUB_CLIENT_ID,
                "client_secret": config.GITHUB_CLIENT_SECRET,
                "code": code,
                "redirect_uri": config.GITHUB_OAUTH_REDIRECT_URI,
            },
            headers={"Accept": "application/json"},
            timeout=10,
        )
        token_response.raise_for_status()
        access_token = token_response.json().get("access_token")
        if not access_token:
            return render_login(request, error="GitHub login failed. Please try again.", next_path=next_path)

        auth_headers = {
            "Authorization": f"Bearer {access_token}",
            "Accept": "application/vnd.github+json",
        }
        profile_response = requests.get("https://api.github.com/user", headers=auth_headers, timeout=10)
        profile_response.raise_for_status()
        profile = profile_response.json()

        emails_response = requests.get("https://api.github.com/user/emails", headers=auth_headers, timeout=10)
        emails_response.raise_for_status()
        emails = emails_response.json()
    except Exception as exc:
        print(f"[/auth/github/callback error] {exc!r}")
        return render_login(request, error="GitHub login failed. Please try again.", next_path=next_path)

    verified_email = None
    for item in emails:
        if item.get("verified") and item.get("primary") and item.get("email"):
            verified_email = item["email"].strip().lower()
            break
    if not verified_email:
        for item in emails:
            if item.get("verified") and item.get("email"):
                verified_email = item["email"].strip().lower()
                break

    if not verified_email:
        return render_login(
            request,
            error="GitHub did not return a verified email address.",
            next_path=next_path,
        )

    github_id = str(profile.get("id") or "")
    github_username = profile.get("login") or ""
    display_name = profile.get("name") or github_username or verified_email.split("@")[0]

    db: Session = SessionLocal()
    try:
        user = db.query(User).filter(User.github_id == github_id).first() if github_id else None
        if not user:
            user = user_by_email(db, verified_email)
            if user:
                was_email_verified = bool(user.email_verified)
                user.github_id = github_id
                user.github_username = github_username
                user.email_verified = True
                if was_email_verified:
                    user.auth_provider = "email,github" if user.password_hash else "github"
                else:
                    # The password was chosen before ownership of this email was
                    # proven. GitHub now proves ownership, so retain the account
                    # row but remove every outstanding email/password credential.
                    user.password_hash = None
                    user.email_verification_token = None
                    user.email_verification_sent_at = None
                    user.password_reset_token = None
                    user.password_reset_sent_at = None
                    user.auth_provider = "github"
        if not user:
            user = User(
                name=display_name,
                email=verified_email,
                password_hash=None,
                plan="free",
                email_verified=True,
                github_id=github_id,
                github_username=github_username,
                auth_provider="github",
                marketing_opt_in=False,
            )
            db.add(user)

        db.commit()
        request.session["user_id"] = user.id
        request.session.pop(POST_AUTH_NEXT_SESSION_KEY, None)
    finally:
        db.close()

    return RedirectResponse(url=next_path, status_code=303)


@app.post("/beta-signup")
def beta_signup(email: str = Form(...)):
    file_exists = BETA_FILE.exists()

    with BETA_FILE.open("a", encoding="utf-8") as f:
        if not file_exists:
            f.write("timestamp,email\n")

        f.write(f"{datetime.now(timezone.utc).isoformat()},{email}\n")

    return RedirectResponse(url="/login?joined=true", status_code=303)


@app.get("/register", response_class=HTMLResponse)
def register_page(request: Request, next: str = ""):
    return render_register(request, next_path=safe_next_path(next))


@app.post("/register")
def register_user(
    request: Request,
    name: str = Form(...),
    email: str = Form(...),
    password: str = Form(...),
    marketing_opt_in: bool = Form(False),
    csrf_token: str = Form(""),
    next: str = Form(""),
):
    next_path = safe_next_path(next)
    if not check_csrf(request, csrf_token):
        return render_register(
            request,
            error="Your session expired. Please try again.",
            next_path=next_path,
        )

    password_error = validate_password_strength(password)
    if password_error:
        return render_register(request, error=password_error, next_path=next_path)

    normalized_email = email.strip().lower()
    track_event(request, "register_submitted", metadata={"email_domain": normalized_email.split("@")[-1] if "@" in normalized_email else ""})

    db: Session = SessionLocal()
    try:
        existing_user = user_by_email(db, normalized_email)

        if existing_user:
            return render_register(
                request,
                next_path=next_path,
                account_exists=True,
            )

        token = new_token()
        opted_in = bool(marketing_opt_in)
        user = User(
            name=name.strip(),
            email=normalized_email,
            password_hash=hash_password(password),
            plan="free",
            email_verified=False,
            email_verification_token=token,
            email_verification_sent_at=now_utc(),
            marketing_opt_in=opted_in,
            marketing_opt_in_at=now_utc() if opted_in else None,
            auth_provider="email",
        )

        db.add(user)
        db.commit()
        request.session[POST_AUTH_NEXT_SESSION_KEY] = next_path
        email_utils.send_verification_email(normalized_email, verification_link(token))
    finally:
        db.close()

    return templates.TemplateResponse(
        request=request,
        name="verify_notice.html",
        context={
            "email": normalized_email,
            "next_path": next_path,
            "login_url": auth_url("/login", next_path),
            **user_context(request),
            **csrf_context(request),
        },
    )


@app.get("/verify-email", response_class=HTMLResponse)
def verify_email(request: Request, token: str = ""):
    next_path = safe_next_path(request.session.get(POST_AUTH_NEXT_SESSION_KEY, ""))
    login_url = auth_url("/login", next_path, verified="true")
    db: Session = SessionLocal()
    try:
        user = db.query(User).filter(User.email_verification_token == token).first() if token else None
        if (
            not user
            or token_age_seconds(user.email_verification_sent_at) > EMAIL_VERIFICATION_MAX_AGE_SECONDS
        ):
            return templates.TemplateResponse(
                request=request,
                name="verify_email_result.html",
                context={
                    "success": False,
                    "message": "That verification link is invalid or expired.",
                    "next_path": next_path,
                    "login_url": auth_url("/login", next_path),
                    **user_context(request),
                    **csrf_context(request),
                },
                status_code=400,
            )

        user.email_verified = True
        user.email_verification_token = None
        user.email_verification_sent_at = None
        db.commit()
        track_event(request, "email_verified", user=user)
    finally:
        db.close()

    return templates.TemplateResponse(
        request=request,
        name="verify_email_result.html",
        context={
            "success": True,
            "message": "Email verified. You can now log in to BashOps.",
            "next_path": next_path,
            "login_url": login_url,
            **user_context(request),
        },
    )


@app.post("/resend-verification", response_class=HTMLResponse)
def resend_verification(
    request: Request,
    email: str = Form(...),
    csrf_token: str = Form(""),
    next: str = Form(""),
):
    next_path = safe_next_path(next or request.session.get(POST_AUTH_NEXT_SESSION_KEY, ""))
    if not check_csrf(request, csrf_token):
        return templates.TemplateResponse(
            request=request,
            name="verify_notice.html",
            context={
                "email": email,
                "message": "Your session expired. Please try again.",
                "next_path": next_path,
                "login_url": auth_url("/login", next_path),
                **user_context(request),
                **csrf_context(request),
            },
        )

    normalized_email = email.strip().lower()
    db: Session = SessionLocal()
    try:
        user = user_by_email(db, normalized_email)
        if user and not user.email_verified:
            token = new_token()
            user.email_verification_token = token
            user.email_verification_sent_at = now_utc()
            db.commit()
            request.session[POST_AUTH_NEXT_SESSION_KEY] = next_path
            email_utils.send_verification_email(normalized_email, verification_link(token))
    finally:
        db.close()

    return templates.TemplateResponse(
        request=request,
        name="verify_notice.html",
        context={
            "email": normalized_email,
            "message": "If the account exists and is unverified, a new verification link has been sent.",
            "next_path": next_path,
            "login_url": auth_url("/login", next_path),
            **user_context(request),
            **csrf_context(request),
        },
    )


@app.get("/forgot-password", response_class=HTMLResponse)
def forgot_password_page(request: Request):
    return templates.TemplateResponse(
        request=request,
        name="forgot_password.html",
        context={"message": None, "error": None, **user_context(request), **csrf_context(request)},
    )


@app.post("/forgot-password", response_class=HTMLResponse)
def forgot_password(
    request: Request,
    email: str = Form(...),
    csrf_token: str = Form(""),
):
    generic_message = "If an account exists, reset instructions have been sent."
    if not check_csrf(request, csrf_token):
        return templates.TemplateResponse(
            request=request,
            name="forgot_password.html",
            context={
                "message": None,
                "error": "Your session expired. Please try again.",
                **user_context(request),
                **csrf_context(request),
            },
        )

    normalized_email = email.strip().lower()
    track_event(request, "forgot_password_requested")
    db: Session = SessionLocal()
    try:
        user = user_by_email(db, normalized_email)
        if user and user.password_hash:
            token = new_token()
            user.password_reset_token = token
            user.password_reset_sent_at = now_utc()
            db.commit()
            email_utils.send_password_reset_email(normalized_email, reset_link(token))
    finally:
        db.close()

    return templates.TemplateResponse(
        request=request,
        name="forgot_password.html",
        context={"message": generic_message, "error": None, **user_context(request), **csrf_context(request)},
    )


@app.get("/reset-password", response_class=HTMLResponse)
def reset_password_page(request: Request, token: str = ""):
    db: Session = SessionLocal()
    try:
        user = db.query(User).filter(User.password_reset_token == token).first() if token else None
        valid = bool(user and token_age_seconds(user.password_reset_sent_at) <= PASSWORD_RESET_MAX_AGE_SECONDS)
    finally:
        db.close()

    return templates.TemplateResponse(
        request=request,
        name="reset_password.html",
        context={
            "token": token if valid else "",
            "valid": valid,
            "error": None if valid else "That reset link is invalid or expired.",
            **user_context(request),
            **csrf_context(request),
        },
        status_code=200 if valid else 400,
    )


@app.post("/reset-password", response_class=HTMLResponse)
def reset_password(
    request: Request,
    token: str = Form(...),
    password: str = Form(...),
    csrf_token: str = Form(""),
):
    if not check_csrf(request, csrf_token):
        return templates.TemplateResponse(
            request=request,
            name="reset_password.html",
            context={
                "token": token,
                "valid": True,
                "error": "Your session expired. Please try again.",
                **user_context(request),
                **csrf_context(request),
            },
        )

    password_error = validate_password_strength(password)
    if password_error:
        return templates.TemplateResponse(
            request=request,
            name="reset_password.html",
            context={
                "token": token,
                "valid": True,
                "error": password_error,
                **user_context(request),
                **csrf_context(request),
            },
        )

    db: Session = SessionLocal()
    try:
        user = db.query(User).filter(User.password_reset_token == token).first() if token else None
        if (
            not user
            or token_age_seconds(user.password_reset_sent_at) > PASSWORD_RESET_MAX_AGE_SECONDS
        ):
            return templates.TemplateResponse(
                request=request,
                name="reset_password.html",
                context={
                    "token": "",
                    "valid": False,
                    "error": "That reset link is invalid or expired.",
                    **user_context(request),
                    **csrf_context(request),
                },
                status_code=400,
            )

        user.password_hash = hash_password(password)
        user.password_reset_token = None
        user.password_reset_sent_at = None
        user.email_verified = True
        db.commit()
    finally:
        db.close()

    return RedirectResponse(url="/login?reset=true", status_code=303)


def admin_event_summary() -> dict:
    today = now_utc().replace(hour=0, minute=0, second=0, microsecond=0)
    funnel_names = [
        "landing_view",
        "register_submitted",
        "analysis_completed",
        "upgrade_clicked",
        "checkout_started",
        "checkout_completed",
    ]

    def empty_summary(db: Session) -> dict:
        def safe_count(query) -> int:
            try:
                return query.count()
            except SQLAlchemyError:
                db.rollback()
                return 0

        return {
            "cards": [
                {"label": "Visitors / Events Today", "value": 0},
                {"label": "Registrations Today", "value": 0},
                {"label": "Verified Users", "value": safe_count(db.query(User).filter(User.email_verified.is_(True)))},
                {"label": "Analyses Today", "value": 0},
                {"label": "Upgrade Clicks Today", "value": 0},
                {"label": "Checkout Starts Today", "value": 0},
                {"label": "Checkout Completions Today", "value": 0},
                {
                    "label": "Free Users",
                    "value": safe_count(db.query(User).filter(User.plan == pricing.FREE_PLAN)),
                },
                {
                    "label": "Pro Users",
                    "value": safe_count(
                        db.query(User).filter(
                            User.plan.in_([pricing.RADAR_PRO_PLAN, pricing.LEGACY_RADAR_PRO_PLAN])
                        )
                    ),
                },
            ],
            "recent_events": [],
            "top_events": [],
            "top_referrers": [],
            "top_repositories": [],
            "funnel": [{"name": name, "count": 0} for name in funnel_names],
            "jobs_categories": [],
            "jobs_positions": [],
            "jobs_overlap": [],
        }

    db: Session = SessionLocal()
    try:
        try:
            events_today = db.query(Event).filter(Event.created_at >= today).all()
            all_events = db.query(Event).order_by(Event.created_at.desc()).limit(50).all()
            jobs_events = (
                db.query(Event)
                .filter(Event.event_name.like("jobs_%"))
                .order_by(Event.created_at.desc())
                .limit(5000)
                .all()
            )
        except SQLAlchemyError as e:
            db.rollback()
            print(f"[/admin/analytics event query unavailable] {e.__class__.__name__}")
            return empty_summary(db)

        def count_today(name: str) -> int:
            return sum(1 for event in events_today if event.event_name == name)

        top_event_rows = (
            db.query(Event.event_name, func.count(Event.id))
            .group_by(Event.event_name)
            .order_by(func.count(Event.id).desc())
            .limit(10)
            .all()
        )
        top_referrer_rows = (
            db.query(Event.referrer, func.count(Event.id))
            .filter(Event.referrer != "")
            .group_by(Event.referrer)
            .order_by(func.count(Event.id).desc())
            .limit(10)
            .all()
        )
        top_repo_rows = (
            db.query(Target.repo, func.count(Target.id))
            .filter(Target.repo != "")
            .group_by(Target.repo)
            .order_by(func.count(Target.id).desc())
            .limit(10)
            .all()
        )

        category_totals = {}
        position_clicks = {}
        for event in jobs_events:
            try:
                metadata = json.loads(event.metadata_json or "{}")
            except (TypeError, ValueError, json.JSONDecodeError):
                metadata = {}
            category = str(metadata.get("category") or "").strip()
            if not re.fullmatch(r"[a-z0-9-]{1,64}", category):
                continue
            totals = category_totals.setdefault(
                category,
                {"category": category, "views": 0, "selections": 0, "clicks": 0, "analyses": 0, "issues": 0},
            )
            if event.event_name == "jobs_category_viewed":
                totals["views"] += 1
            elif event.event_name == "jobs_category_selected":
                totals["selections"] += 1
            elif event.event_name == "jobs_repository_clicked":
                totals["clicks"] += 1
                try:
                    position = max(0, min(int(metadata.get("position") or 0), 100))
                except (TypeError, ValueError):
                    position = 0
                if position:
                    position_clicks[position] = position_clicks.get(position, 0) + 1
            elif event.event_name == "jobs_analysis_started":
                totals["analyses"] += 1
            elif event.event_name == "jobs_issue_opened":
                totals["issues"] += 1
        jobs_categories = []
        for totals in category_totals.values():
            totals["click_through_rate"] = round((totals["clicks"] / totals["views"]) * 100, 1) if totals["views"] else 0
            jobs_categories.append(totals)
        jobs_categories.sort(key=lambda value: (-value["analyses"], -value["clicks"], value["category"]))

        overlap_counts = {}
        try:
            overlap_sections = curated_opportunity_sections(load_feed_items(db))
        except SQLAlchemyError:
            db.rollback()
            overlap_sections = []
        for section in overlap_sections:
            if section["key"] == "trending":
                continue
            for item in section["items"]:
                overlap_counts[item.repository_full_name] = overlap_counts.get(item.repository_full_name, 0) + 1
        jobs_overlap = [
            {"repository": repository, "categories": count}
            for repository, count in sorted(overlap_counts.items(), key=lambda value: (-value[1], value[0].casefold()))
            if count > 1
        ][:10]

        return {
            "cards": [
                {"label": "Visitors / Events Today", "value": len(events_today)},
                {"label": "Registrations Today", "value": count_today("register_submitted")},
                {"label": "Verified Users", "value": db.query(User).filter(User.email_verified.is_(True)).count()},
                {"label": "Analyses Today", "value": count_today("analysis_completed")},
                {"label": "Upgrade Clicks Today", "value": count_today("upgrade_clicked")},
                {"label": "Checkout Starts Today", "value": count_today("checkout_started")},
                {"label": "Checkout Completions Today", "value": count_today("checkout_completed")},
                {
                    "label": "Free Users",
                    "value": db.query(User).filter(User.plan == pricing.FREE_PLAN).count(),
                },
                {
                    "label": "Pro Users",
                    "value": db.query(User)
                    .filter(User.plan.in_([pricing.RADAR_PRO_PLAN, pricing.LEGACY_RADAR_PRO_PLAN]))
                    .count(),
                },
            ],
            "recent_events": [
                {
                    "event_name": event.event_name,
                    "page": event.page or "",
                    "referrer": event.referrer or "",
                    "created_at": event.created_at,
                }
                for event in all_events
            ],
            "top_events": [{"name": name, "count": count} for name, count in top_event_rows],
            "top_referrers": [{"referrer": referrer, "count": count} for referrer, count in top_referrer_rows],
            "top_repositories": [{"repo": repo, "count": count} for repo, count in top_repo_rows],
            "funnel": [{"name": name, "count": db.query(Event).filter(Event.event_name == name).count()} for name in funnel_names],
            "jobs_categories": jobs_categories[:12],
            "jobs_positions": [
                {"position": position, "clicks": clicks}
                for position, clicks in sorted(position_clicks.items(), key=lambda value: (-value[1], value[0]))[:10]
            ],
            "jobs_overlap": jobs_overlap,
        }
    finally:
        db.close()


@app.get("/admin/analytics", response_class=HTMLResponse)
def analytics_dashboard(request: Request):
    current_user = get_current_user(request)

    # Previously this route had no auth at all and showed every user's data
    # to any visitor. It's now restricted to a single admin account
    # (set ADMIN_EMAILS in the environment) since it's a global view across
    # all accounts, not a per-user page.
    admin_response = require_admin_or_redirect(request, current_user)
    if admin_response:
        return admin_response

    summary = admin_event_summary()
    return templates.TemplateResponse(
        request=request,
        name="analytics.html",
        context={**summary, **user_context(request, current_user)},
    )


@app.get("/admin/users", response_class=HTMLResponse)
def admin_users(request: Request):
    current_user = get_current_user(request)
    admin_response = require_admin_or_redirect(request, current_user)
    if admin_response:
        return admin_response

    db: Session = SessionLocal()
    try:
        users = db.query(User).order_by(User.created_at.desc()).limit(50).all()
        total_users = db.query(User).count()
        verified_users = db.query(User).filter(User.email_verified.is_(True)).count()
        marketing_users = db.query(User).filter(User.marketing_opt_in.is_(True)).count()
        free_users = db.query(User).filter(User.plan == pricing.FREE_PLAN).count()
        pro_users = db.query(User).filter(
            User.plan.in_([pricing.RADAR_PRO_PLAN, pricing.LEGACY_RADAR_PRO_PLAN])
        ).count()
        recent_signups = (
            db.query(User)
            .order_by(User.created_at.desc())
            .limit(5)
            .all()
        )
    finally:
        db.close()

    return templates.TemplateResponse(
        request=request,
        name="admin_users.html",
        context={
            "users": users,
            "recent_signups": recent_signups,
            "total_users": total_users,
            "verified_users": verified_users,
            "unverified_users": total_users - verified_users,
            "marketing_users": marketing_users,
            "free_users": free_users,
            "pro_users": pro_users,
            **user_context(request, current_user),
        },
    )


@app.get("/pipeline", response_class=HTMLResponse)
def pipeline(request: Request):
    current_user = get_current_user(request)

    if not current_user:
        return RedirectResponse(url="/login", status_code=303)

    summary = analytics_summary(user_id=current_user.id)
    return templates.TemplateResponse(
        request=request,
        name="pipeline.html",
        context={**summary, **user_context(request, current_user), **csrf_context(request)},
    )


@app.get("/analysis/{target_id}", response_class=HTMLResponse)
def saved_analysis(request: Request, target_id: int):
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url="/login", status_code=303)

    db: Session = SessionLocal()
    try:
        target = db.query(Target).filter(Target.id == target_id, Target.user_id == current_user.id).first()
        if not target:
            return RedirectResponse(url="/pipeline", status_code=303)

        repo_url = target.repo_url or f"https://github.com/{target.repo}"
    finally:
        db.close()

    try:
        track_event(request, "analysis_reopened", user=current_user, metadata={"target_id": target_id, "repo_url": repo_url})
        result = build_analysis_result(repo_url)
        best_issue = result.get("best_issue")
        ai_summary = generate_ai_summary(
            repo_full_name=result["repo"],
            repo=result["repo_data"],
            best_issue=best_issue,
            repo_score=result["score"],
            angle=result["angle"],
            languages=result.get("languages"),
            repository_intelligence=result.get("repository_intelligence"),
            confidence=(result.get("score_transparency") or {}).get("confidence"),
            recommendation_label=result.get("score_action"),
        )
        result["ai_summary"] = ai_summary["text"]
        result["ai_status"] = ai_summary["status"]

        return templates.TemplateResponse(
            request=request,
            name="analysis_result.html",
            context={
                "result": result,
                "error": None,
                "limit_reached": False,
                "from_discover": False,
                "site_url": config.SITE_URL,
                **pricing.template_context(),
                **user_context(request, current_user),
                **csrf_context(request),
            },
        )
    except Exception as e:
        print(f"[/analysis/{target_id} error] {e!r}")
        return templates.TemplateResponse(
            request=request,
            name="analysis_result.html",
            context={
                "result": None,
                "error": "Something went wrong reopening that analysis. Please try again.",
                "limit_reached": False,
                "from_discover": False,
                "site_url": config.SITE_URL,
                **pricing.template_context(),
                **user_context(request, current_user),
                **csrf_context(request),
            },
        )

SNAPSHOT_STAGE_COPY = {
    "New Target": (
        "Researching",
        "Evaluating this repository as a focused proof-of-work opportunity.",
    ),
    "Researching": (
        "Researching",
        "Evaluating this repository as a focused proof-of-work opportunity.",
    ),
    "Working": (
        "Working",
        "Actively working on a contribution for this repository.",
    ),
    "PR Submitted": (
        "PR Submitted",
        "A pull request has been submitted for review.",
    ),
    "PR Merged": (
        "PR Merged",
        "The contribution has been accepted and merged.",
    ),
    "Founder Contacted": (
        "Founder Contacted",
        "The contribution is now supporting a direct project conversation.",
    ),
    "Paid Sprint": (
        "Paid Sprint",
        "This proof-of-work journey has progressed into paid sprint work.",
    ),
    "Retainer": (
        "Retainer",
        "This contribution relationship has progressed into ongoing work.",
    ),
}


def snapshot_issue_focus(target_data: dict, result: Optional[dict] = None) -> str:
    best_issue = (result or {}).get("best_issue") or {}
    issue_type = best_issue.get("type")
    if issue_type:
        return issue_type

    stored_issue = (target_data.get("best_issue") or "").strip()
    if stored_issue and not stored_issue.startswith("#"):
        return stored_issue[:90]

    return "Focused open-source contribution"


@app.get("/pipeline/{target_id}/snapshot", response_class=HTMLResponse)
def proof_of_work_snapshot(request: Request, target_id: int):
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url="/login", status_code=303)

    db: Session = SessionLocal()
    try:
        target = db.query(Target).filter(Target.id == target_id, Target.user_id == current_user.id).first()
        if not target:
            raise HTTPException(status_code=404, detail="Snapshot not found")

        first_target = (
            db.query(Target)
            .filter(Target.user_id == current_user.id)
            .order_by(Target.created_at.asc(), Target.id.asc())
            .first()
        )
        first_target_id = first_target.id if first_target else target.id
        repo_url = target.repo_url or (f"https://github.com/{target.repo}" if target.repo else "")

        snapshot_target = {
            "id": target.id,
            "repo": target.repo or "Unknown repository",
            "repo_url": repo_url,
            "score": target.score if target.score is not None else 0,
            "status": target.status or "New Target",
            "language": target.language or "Unknown",
            "difficulty": target.difficulty or "Estimate unavailable",
            "merge_probability": target.merge_probability or "Estimate unavailable",
            "estimated_time": target.estimated_time or "Estimate unavailable",
            "stars": target.stars or 0,
            "forks": target.forks or 0,
            "open_issues": target.open_issues or 0,
            "best_issue": target.best_issue or "",
        }
    finally:
        db.close()

    has_access = has_pro_access(current_user)
    stage_label, stage_copy = SNAPSHOT_STAGE_COPY.get(
        snapshot_target["status"],
        ("Researching", "Evaluating this repository as a focused proof-of-work opportunity."),
    )
    free_stage_allowed = stage_label == "Researching"
    free_target_allowed = target_id == first_target_id
    locked = not has_access and (not free_target_allowed or not free_stage_allowed)

    if locked:
        return templates.TemplateResponse(
            request=request,
            name="proof_of_work_snapshot.html",
            context={
                "locked": True,
                "stage_label": stage_label,
                "stage_copy": stage_copy,
                "target": None,
                "signals": [],
                "focus": "",
                "site_url": config.SITE_URL,
                **user_context(request, current_user),
            },
        )

    signals = []
    focus = snapshot_issue_focus(snapshot_target)
    if snapshot_target["repo_url"]:
        try:
            result = build_analysis_result(snapshot_target["repo_url"])
            signals = (result.get("score_transparency") or {}).get("reasons", [])[:5]
            focus = snapshot_issue_focus(snapshot_target, result)
        except Exception as e:
            print(f"[/pipeline/{target_id}/snapshot analysis enrich error] {e!r}")

    track_event(
        request,
        "snapshot_viewed",
        user=current_user,
        metadata={
            "target_id": target_id,
            "repo": snapshot_target["repo"],
            "plan": "pro" if has_access else "free",
            "stage": stage_label,
        },
    )

    return templates.TemplateResponse(
        request=request,
        name="proof_of_work_snapshot.html",
        context={
            "locked": False,
            "stage_label": stage_label,
            "stage_copy": stage_copy,
            "target": snapshot_target,
            "signals": signals,
            "focus": focus,
            "site_url": config.SITE_URL,
            **user_context(request, current_user),
        },
    )

@app.post("/analyze", response_class=HTMLResponse)
def analyze(
    request: Request,
    repo_url: str = Form(...),
    csrf_token: str = Form(""),
    source: str = Form(""),
):
    current_user = get_current_user(request)
    ip = request.client.host if request.client else "unknown"

    try:
        if not check_csrf(request, csrf_token):
            return templates.TemplateResponse(
                request=request,
                name="analysis_result.html",
                context={
                    "result": None,
                    "error": "Your session expired. Please try again.",
                    "limit_reached": False,
                    "from_discover": source == "discover",
                    "site_url": config.SITE_URL,
                    **pricing.template_context(),
                    **user_context(request, current_user),
                    **csrf_context(request),
                },
            )

        if source == "discover":
            track_event(
                request,
                "discover_result_clicked",
                user=current_user,
                metadata={"repo_url": repo_url},
            )

        if current_user and not has_pro_access(current_user) and not current_user.email_verified:
            track_event(
                request,
                "free_analysis_blocked",
                user=current_user,
                metadata={"reason": "email_unverified"},
            )
            return templates.TemplateResponse(
                request=request,
                name="analysis_result.html",
                context={
                    "result": None,
                    "error": None,
                    "limit_reached": False,
                    "verification_required": True,
                    "from_discover": source == "discover",
                    "site_url": config.SITE_URL,
                    **pricing.template_context(),
                    **user_context(request, current_user),
                    **csrf_context(request),
                },
            )

        if current_user:
            count = free_account_analysis_count(current_user)
            over_limit = not has_pro_access(current_user) and count >= FREE_ANALYSIS_LIMIT
            limit_type = "account"
        else:
            over_limit = anonymous_website_analysis_used(request, ip)
            limit_type = "anonymous"

        if over_limit:
            track_event(
                request,
                "free_analysis_blocked",
                user=current_user,
                metadata={"reason": limit_type, "repo_url": repo_url},
            )
            return templates.TemplateResponse(
                request=request,
                name="analysis_result.html",
                context={
                    "result": None,
                    "error": None,
                    "limit_reached": True,
                    "limit_type": limit_type,
                    "from_discover": source == "discover",
                    "site_url": config.SITE_URL,
                    **pricing.template_context(),
                    **user_context(request, current_user),
                    **csrf_context(request),
                },
            )

        track_event(request, "analysis_started", user=current_user, metadata={"repo_url": repo_url})
        result = build_analysis_result(repo_url)
        best_issue = result.get("best_issue")

        ai_summary = generate_ai_summary(
            repo_full_name=result["repo"],
            repo=result["repo_data"],
            best_issue=best_issue,
            repo_score=result["score"],
            angle=result["angle"],
            languages=result.get("languages"),
            repository_intelligence=result.get("repository_intelligence"),
            confidence=(result.get("score_transparency") or {}).get("confidence"),
            recommendation_label=result.get("score_action"),
        )

        result["ai_summary"] = ai_summary["text"]
        result["ai_status"] = ai_summary["status"]

        track_analysis(
            repo=result["repo"],
            repo_url=result["repo_url"],
            score=result["score"],
            best_issue=f"#{best_issue['number']}" if best_issue else "",
            best_issue_url=best_issue["url"] if best_issue else "",
            request=request,
            user_id=current_user.id if current_user else None,
            language=result.get("language", "Unknown"),
            stars=result.get("stars", 0),
            forks=result.get("forks", 0),
            open_issues=result.get("open_issues", 0),
            merge_probability=result.get("merge_probability"),
            difficulty=result.get("difficulty"),
            estimated_time=result.get("estimated_time"),
        )

        if current_user and not has_pro_access(current_user):
            used_count = free_account_analysis_count(current_user)
            remaining_count = max(FREE_ANALYSIS_LIMIT - used_count, 0)
            track_event(
                request,
                "free_analysis_completed",
                user=current_user,
                metadata={"repo": result["repo"], "remaining": remaining_count},
            )
            if remaining_count == 0:
                track_event(
                    request,
                    "free_trial_completed",
                    user=current_user,
                    metadata={"repo": result["repo"]},
                )
        elif not current_user:
            request.session["anonymous_analysis_used"] = True
            track_event(
                request,
                "free_analysis_completed",
                metadata={"repo": result["repo"], "anonymous": True},
            )

        track_event(
            request,
            "analysis_completed",
            user=current_user,
            metadata={"repo": result["repo"], "score": result["score"]},
        )

        return templates.TemplateResponse(
            request=request,
            name="analysis_result.html",
            context={
                "result": result,
                "error": None,
                "limit_reached": False,
                "from_discover": source == "discover",
                "site_url": config.SITE_URL,
                **pricing.template_context(),
                **user_context(request, current_user),
                **csrf_context(request),
            },
        )

    except Exception as e:
        # Only a safe, generic message reaches the user now — raw
        # exception text (which can include GitHub API response bodies)
        # is logged server-side instead of rendered into the page.
        print(f"[/analyze error] {e!r}")

        error_text = str(e)
        safe_prefixes = (
            "Please provide a valid",
            "Private repositories are not supported.",
            "GitHub API rate limit",
            "GitHub API timed out",
            "Could not connect to GitHub API",
        )
        message = error_text if error_text.startswith(safe_prefixes) else (
            "Something went wrong analyzing that repository. Please check the URL and try again."
        )

        return templates.TemplateResponse(
            request=request,
            name="analysis_result.html",
            context={
                "result": None,
                "error": message,
                "limit_reached": False,
                "from_discover": source == "discover",
                "site_url": config.SITE_URL,
                **pricing.template_context(),
                **user_context(request, current_user),
                **csrf_context(request),
            },
        )


@app.post("/api/v1/analyze")
async def api_analyze(request: Request):
    current_user = get_current_user(request)
    ip = request.client.host if request.client else "unknown"
    site_url = config.SITE_URL.rstrip("/")

    try:
        payload = await request.json()
    except Exception:
        return JSONResponse({"error": "Invalid JSON payload."}, status_code=400)

    repo_url = (payload.get("repo_url") or "").strip()
    issue_number = payload.get("issue_number")
    if not repo_url:
        return JSONResponse({"error": "repo_url is required."}, status_code=400)

    if current_user:
        count = daily_analysis_count(user_id=current_user.id)
        over_limit = not has_pro_access(current_user) and count >= FREE_ANALYSIS_LIMIT
    else:
        count = daily_analysis_count(ip=ip)
        over_limit = count >= FREE_ANALYSIS_LIMIT

    if over_limit:
        return JSONResponse(
            {
                "error": "Free analysis limit reached.",
                "upgrade_url": f"{site_url}/pricing",
            },
            status_code=429,
        )

    client_name = request.headers.get("X-BashOps-Client", "").strip().lower()
    event_prefix = "github_action" if client_name == "github-action" else "api"
    track_event(
        request,
        f"{event_prefix}_analysis_started",
        user=current_user,
        metadata={"repo_url": repo_url},
    )

    try:
        result = build_analysis_result(repo_url, issue_number=issue_number)
        response_payload = to_public_api_payload(result, site_url)

        try:
            best_issue = result.get("best_issue")
            track_analysis(
                repo=result["repo"],
                repo_url=result["repo_url"],
                score=result["score"],
                best_issue=f"#{best_issue['number']}" if best_issue else "",
                best_issue_url=best_issue["url"] if best_issue else "",
                request=request,
                user_id=current_user.id if current_user else None,
                language=result.get("language", "Unknown"),
                stars=result.get("stars", 0),
                forks=result.get("forks", 0),
                open_issues=result.get("open_issues", 0),
                merge_probability=result.get("merge_probability"),
                difficulty=result.get("difficulty"),
                estimated_time=result.get("estimated_time"),
            )
        except Exception as e:
            print(f"[/api/v1/analyze tracking error] {e!r}")

        track_event(
            request,
            f"{event_prefix}_analysis_completed",
            user=current_user,
            metadata={"repo": result["repo"], "score": result["score"]},
        )
        return response_payload
    except Exception as e:
        print(f"[/api/v1/analyze error] {e!r}")
        error_text = str(e)
        safe_prefixes = (
            "Please provide a valid",
            "Private repositories are not supported.",
            "GitHub API rate limit",
            "GitHub API timed out",
            "Could not connect to GitHub API",
        )
        message = (
            error_text
            if error_text.startswith(safe_prefixes)
            else "Something went wrong analyzing that repository. Please check the URL and try again."
        )
        status_code = 429 if "rate limit" in error_text.lower() else 400
        return JSONResponse({"error": message}, status_code=status_code)


@app.get("/dashboard", response_class=HTMLResponse)
def dashboard(request: Request):
    current_user = get_current_user(request)

    if not current_user:
        return RedirectResponse(url="/login", status_code=303)

    summary = analytics_summary(user_id=current_user.id)
    analyses_used_total = free_account_analysis_count(current_user)
    analyses_remaining = None
    if not has_pro_access(current_user):
        analyses_remaining = max(FREE_ANALYSIS_LIMIT - analyses_used_total, 0)

    return templates.TemplateResponse(
        request=request,
        name="dashboard.html",
        context={
            **summary,
            "free_analysis_limit": FREE_ANALYSIS_LIMIT,
            "analyses_used_total": analyses_used_total,
            "analyses_remaining": analyses_remaining,
            **pricing.template_context(),
            **user_context(request, current_user),
            **csrf_context(request),
        },
    )


@app.post("/update-status")
def update_status(
    request: Request,
    repo: str = Form(...),
    status: str = Form(...),
    csrf_token: str = Form(""),
):
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url="/login", status_code=303)

    if check_csrf(request, csrf_token):
        update_pipeline_status(repo, status, user_id=current_user.id)

    return RedirectResponse(url="/pipeline", status_code=303)


@app.post("/generate-pitch", response_class=HTMLResponse)
def pitch_preview(
    request: Request,
    repo: str = Form(...),
    best_issue: str = Form(""),
    csrf_token: str = Form(""),
):
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url="/login", status_code=303)

    summary = analytics_summary(user_id=current_user.id)

    if not check_csrf(request, csrf_token):
        return templates.TemplateResponse(
            request=request,
            name="pipeline.html",
            context={**summary, **user_context(request, current_user), **csrf_context(request)},
        )

    if not has_pro_access(current_user):
        return templates.TemplateResponse(
            request=request,
            name="pipeline.html",
            context={
                **summary,
                **user_context(request, current_user),
                "pitch_upgrade_message": "Founder pitch generation is a Pro feature. Upgrade to prepare focused outreach after your first useful pull request.",
                **csrf_context(request),
            },
        )

    pitch = generate_pitch(repo, best_issue)
    save_pitch(repo, current_user.id, pitch)

    summary = analytics_summary(user_id=current_user.id)

    return templates.TemplateResponse(
        request=request,
        name="pipeline.html",
        context={
            **summary,
            **user_context(request, current_user),
            "generated_pitch": pitch,
            "pitch_repo": repo,
            "pitch_is_pro": True,
            **csrf_context(request),
        },
    )


# --- Billing (Paddle) ------------------------------------------------------
@app.get("/billing/upgrade")
def billing_upgrade(request: Request, billing_period: str = "monthly"):
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url="/register", status_code=303)

    track_event(request, "upgrade_clicked", user=current_user)

    if has_pro_access(current_user):
        return RedirectResponse(url="/dashboard", status_code=303)

    billing_period = billing_period if billing_period in {"monthly", "annual"} else "monthly"
    paddle_price_id = pricing.price_id("radar", billing_period)
    if not config.PADDLE_CLIENT_TOKEN or not paddle_price_id:
        return templates.TemplateResponse(
            request=request,
            name="pricing.html",
            context={
                "billing_error": "Billing is not configured yet. Set Paddle environment variables before accepting payments.",
                **pricing.template_context(),
                "site_url": config.SITE_URL,
                **user_context(request, current_user),
            },
        )

    track_event(request, "checkout_started", user=current_user)
    return templates.TemplateResponse(
        request=request,
        name="checkout.html",
        context={
            "paddle_client_token": config.PADDLE_CLIENT_TOKEN,
            "paddle_price_id": paddle_price_id,
            "paddle_env": config.PADDLE_ENV,
            "billing_period": billing_period,
            "user_email": current_user.email,
            "user_id": current_user.id,
            "site_url": config.SITE_URL,
            **user_context(request, current_user),
        },
    )


@app.get("/billing/success")
def billing_success(request: Request):
    # The plan upgrade itself happens from the verified webhook, not this
    # redirect — a user landing here without paying stays on whatever plan
    # they already had. This page is just a friendly landing spot.
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url="/login", status_code=303)
    return templates.TemplateResponse(
        request=request,
        name="billing_success.html",
        context={**user_context(request, current_user), "site_url": config.SITE_URL},
    )


@app.get("/billing/manage", response_class=HTMLResponse)
def billing_manage(request: Request):
    current_user = get_current_user(request)
    if not current_user:
        return RedirectResponse(url="/login", status_code=303)
    return templates.TemplateResponse(
        request=request,
        name="billing_manage.html",
        context={**user_context(request, current_user), "site_url": config.SITE_URL},
    )


@app.post("/billing/webhook")
async def paddle_webhook(request: Request):
    payload = await request.body()

    try:
        event = paddle_billing.verify_paddle_webhook(payload, request.headers)
    except paddle_billing.PaddleBillingNotConfigured as e:
        print(f"[/billing/webhook not configured] {e!r}")
        return JSONResponse({"error": "billing not configured"}, status_code=500)
    except paddle_billing.PaddleSignatureError as e:
        print(f"[/billing/webhook signature error] {e!r}")
        return JSONResponse({"error": "invalid signature"}, status_code=400)
    except Exception as e:
        print(f"[/billing/webhook parse error] {e!r}")
        return JSONResponse({"error": "invalid payload"}, status_code=400)

    try:
        handled_products = paddle_billing.handle_paddle_webhook_event(event)
    except Exception as e:
        print(f"[/billing/webhook handler error] {e!r}")
        return JSONResponse({"error": "webhook handling failed"}, status_code=500)

    if handled_products and event.get("event_type") in {"transaction.completed", "subscription.created", "subscription.updated"}:
        track_event(
            request,
            "checkout_completed",
            metadata={
                "event_type": event.get("event_type"),
                "products": sorted(handled_products),
            },
        )

    return {"received": True}