app.py

# -----------------------------------------------------------------------------------
# Imports
# -----------------------------------------------------------------------------------

import os
import uuid
from datetime import datetime, timezone
from functools import wraps

import requests
from dotenv import load_dotenv
from flask import Flask, render_template, request, redirect, url_for, session, abort, flash
from flask_wtf.csrf import CSRFProtect
from flask_sqlalchemy import SQLAlchemy
from google.api_core.exceptions import PermissionDenied
from google.cloud import firestore
from sqlalchemy.exc import OperationalError
from sqlalchemy import and_
from sqlalchemy import func
from urllib.parse import urlparse
from uuid import uuid4
from werkzeug.security import generate_password_hash, check_password_hash
from werkzeug.utils import secure_filename

try:
    from google.cloud import storage
except Exception:
    storage = None


# -----------------------------------------------------------------------------------
# Setup
# -----------------------------------------------------------------------------------

load_dotenv()

app = Flask(__name__)
app.secret_key = os.getenv("SECRET_KEY")

app.config["WTF_CSRF_TIME_LIMIT"] = 60 * 60
csrf = CSRFProtect(app)

cloud_function_url = os.getenv("CLOUD_FUNCTION_URL")

IS_GAE = bool(os.getenv("GAE_ENV", "").startswith("standard"))
bucket_name = os.getenv("BUCKET_NAME")

app.config["MAX_CONTENT_LENGTH"] = 5 * 1024 * 1024
ALLOWED_EXTENSIONS = {"png", "jpg", "jpeg", "webp"}

if not bucket_name:
    app.config["UPLOAD_FOLDER"] = "/tmp/uploads" if IS_GAE else os.path.join("static", "uploads")
    os.makedirs(app.config["UPLOAD_FOLDER"], exist_ok=True)
else:
    app.config["UPLOAD_FOLDER"] = None

IS_DEV = os.getenv("FLASK_ENV") == "development" or os.getenv("APP_ENV") == "development" or not IS_GAE


# -----------------------------------------------------------------------------------
# Database setup (SQLAlchemy & Firestore)
# -----------------------------------------------------------------------------------

# SQLAlchemy
database_url = os.getenv("DATABASE_URL") or "sqlite:///society.db"
app.config["SQLALCHEMY_DATABASE_URI"] = database_url
app.config["SQLALCHEMY_TRACK_MODIFICATIONS"] = False

db = SQLAlchemy(app)


# Firestore
firestore_db = firestore.Client()

def utcnow_naive():
    return datetime.now(timezone.utc).replace(tzinfo=None)

def mirror_event_to_firestore(event):
    if not firestore_db:
        return
    try:
        firestore_db.collection("events_mirror").document(str(event.id)).set({
            "event_id": event.id,
            "title": event.title,
            "location": event.location,
            "start_time": event.start_time.isoformat() if event.start_time else None,
            "end_time": event.end_time.isoformat() if event.end_time else None,
            "image_url": event.image_url,
            "created_by": event.created_by,
            "updated_at": utcnow_naive().isoformat(),
        }, merge=True)
    except Exception:
        pass

def delete_event_mirror(event_id: int):
    if not firestore_db:
        return
    try:
        firestore_db.collection("events_mirror").document(str(event_id)).delete()
        firestore_db.collection("event_stats").document(str(event_id)).delete()
    except Exception:
        pass

def update_event_stats_firestore(event_id: int, delta_going: int):
    if not firestore_db:
        return
    try:
        doc_ref = firestore_db.collection("event_stats").document(str(event_id))

        @firestore.transactional
        def _txn_update(transaction):
            snap = doc_ref.get(transaction=transaction)
            current = 0
            if snap.exists:
                current = int(snap.to_dict().get("going_count", 0))
            new_val = max(0, current + delta_going)
            transaction.set(doc_ref, {
                "event_id": event_id,
                "going_count": new_val,
                "updated_at": utcnow_naive().isoformat()
            }, merge=True)

        transaction = firestore_db.transaction()
        _txn_update(transaction)
    except Exception:
        pass


# -----------------------------------------------------------------------------------
# SQL Models
# -----------------------------------------------------------------------------------

class User(db.Model):
    __tablename__ = "users"
    id = db.Column(db.Integer, primary_key=True)
    first_name = db.Column(db.String(100), nullable=False)
    last_name = db.Column(db.String(100), nullable=False)
    email = db.Column(db.String(255), unique=True, nullable=False, index=True)
    password_hash = db.Column(db.String(255), nullable=False)
    role = db.Column(db.String(20), default="member", nullable=False)
    committee_position = db.Column(db.String(50), nullable=True)
    created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)

class Event(db.Model):
    __tablename__ = "events"
    id = db.Column(db.Integer, primary_key=True)
    title = db.Column(db.String(200), nullable=False)
    description = db.Column(db.Text, nullable=True)
    location = db.Column(db.String(200), nullable=True)
    start_time = db.Column(db.DateTime, nullable=False)
    end_time = db.Column(db.DateTime, nullable=False)
    created_by = db.Column(db.Integer, db.ForeignKey("users.id"), nullable=False)
    image_url = db.Column(db.String(500), nullable=True)

class RSVP(db.Model):
    __tablename__ = "rsvps"
    user_id = db.Column(db.Integer, db.ForeignKey("users.id"), primary_key=True)
    event_id = db.Column(db.Integer, db.ForeignKey("events.id"), primary_key=True)
    status = db.Column(db.String(20), default="going", nullable=False)
    created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)


# -----------------------------------------------------------------------------------
# Functions (helpers, authentication, template contexts)
# -----------------------------------------------------------------------------------

def get_current_user():
    email = session.get("user")
    if not email:
        return None
    return User.query.filter_by(email=email).first()

def login_required(view_func):
    @wraps(view_func)
    def wrapped(*args, **kwargs):
        if not session.get("user"):
            return redirect(url_for("login"))
        return view_func(*args, **kwargs)
    return wrapped

def committee_or_admin_required(view_func):
    @wraps(view_func)
    def wrapped(*args, **kwargs):
        if not session.get("user"):
            return redirect(url_for("login"))
        if session.get("role") not in ["committee", "admin"]:
            abort(403)
        return view_func(*args, **kwargs)
    return wrapped

def admin_required(view_func):
    @wraps(view_func)
    def wrapped(*args, **kwargs):
        if not session.get("user"):
            return redirect(url_for("login"))
        if session.get("role") != "admin":
            abort(403)
        return view_func(*args, **kwargs)
    return wrapped

@app.context_processor
def inject_user_context():
    user = None
    try:
        user = get_current_user()
    except OperationalError:
        user = None

    return {
        "current_user": user,
        "current_role": session.get("role"),
        "current_email": session.get("user"),
    }

def safe_referrer(default):
    ref = request.referrer
    if not ref:
        return default
    if urlparse(ref).netloc and urlparse(ref).netloc != request.host:
        return default
    return ref

def allowed_file(filename: str) -> bool:
    return "." in filename and filename.rsplit(".", 1)[1].lower() in ALLOWED_EXTENSIONS

def parse_dt_local(value: str) -> datetime:
    return datetime.strptime(value, "%Y-%m-%dT%H:%M")


# -----------------------------------------------------------------------------------
# Logging / integrations
# -----------------------------------------------------------------------------------

def log_action(action, user=None, extra=None):
    if firestore_db is None:
        return

    data = {"action": action, "timestamp": datetime.now(timezone.utc).replace(tzinfo=None)}

    if user:
        data["user"] = user.email
        data["user_id"] = user.id
        data["role"] = user.role

    if extra:
        data.update(extra)

    try:
        firestore_db.collection("activity_logs").add(data)
    except PermissionDenied as e:
        print("Firestore permission denied - logging skipped:", e)
    except Exception as e:
        print("Firestore logging failed - skipped:", e)

def call_rsvp_cloud_function(user, event, status):
    if not cloud_function_url:
        return

    payload = {
        "user_email": user.email,
        "event_id": event.id,
        "new_status": status
    }

    try:
        requests.post(cloud_function_url, json=payload, timeout=3)
    except Exception as e:
        print("Cloud Function call failed:", e)


# -----------------------------------------------------------------------------------
# Image upload
# -----------------------------------------------------------------------------------

def upload_event_image(image_file):
    if not image_file or not image_file.filename:
        return None

    if not allowed_file(image_file.filename):
        abort(400, description="Invalid image type. Use PNG/JPG/WebP.")

    bucket_name = os.getenv("BUCKET_NAME")

    if bucket_name:
        if storage is None:
            abort(500, description="google-cloud-storage not installed but BUCKET_NAME is set.")

        client = storage.Client()
        bucket = client.bucket(bucket_name)

        ext = image_file.filename.rsplit(".", 1)[1].lower()
        blob_name = f"event-images/{uuid.uuid4().hex}.{ext}"

        blob = bucket.blob(blob_name)
        blob.upload_from_file(image_file.stream, content_type=image_file.mimetype)

        return f"https://storage.googleapis.com/{bucket_name}/{blob_name}"

    # Fallback for local development
    upload_dir = app.config.get("UPLOAD_FOLDER") or ("/tmp/uploads" if IS_GAE else os.path.join("static", "uploads"))
    os.makedirs(upload_dir, exist_ok=True)

    ext = image_file.filename.rsplit(".", 1)[1].lower()
    filename = secure_filename(f"{uuid.uuid4().hex}.{ext}")
    save_path = os.path.join(upload_dir, filename)
    image_file.save(save_path)

    if upload_dir.startswith("static"):
        return url_for("static", filename=f"uploads/{filename}")


# -----------------------------------------------------------------------------------
# Routes: Admin backdoors
# -----------------------------------------------------------------------------------

@app.route("/init-db")
def init_db():
    if not IS_DEV:
        abort(404)
    db.create_all()

    return "DB initialised! You can now register/login."

@app.route("/make-me-admin")
@login_required
def make_me_admin():
    if not IS_DEV:
        abort(404)
    user = get_current_user()
    user.role = "admin"
    db.session.commit()
    session["role"] = "admin"

    return "You are now admin."

@app.route("/admin/users", methods=["GET", "POST"])
@admin_required
def admin_users():
    users = User.query.order_by(User.first_name.asc()).all()

    if request.method == "POST":
        user_id = int(request.form["user_id"])
        is_committee = request.form.get("is_committee") == "on"
        position = request.form.get("committee_position")
        user = User.query.get_or_404(user_id)

        if is_committee:
            user.role = "committee"
            user.committee_position = position
        else:
            user.role = "member"
            user.committee_position = None

        db.session.commit()

        log_action(
            "ROLE_UPDATED",
            user=get_current_user(),
            extra={
                "target_user_id": user.id,
                "target_email": user.email,
                "new_role": user.role,
                "committee_position": user.committee_position
            }
        )

        return redirect(url_for("admin_users"))
    return render_template("admin/users.html", users=users)

@app.route("/admin/logs")
@admin_required
def admin_logs():
    logs = (
        firestore_db.collection("activity_logs")
        .order_by("timestamp", direction=firestore.Query.DESCENDING)
        .limit(50)
        .stream()
    )

    return render_template("admin/logs.html", logs=logs)


# -----------------------------------------------------------------------------------
# Routes: Authentication & Home
# -----------------------------------------------------------------------------------

@app.route("/register", methods=["GET", "POST"])
def register():
    if request.method == "POST":
        first_name = request.form["first_name"].strip()
        last_name = request.form["last_name"].strip()
        email = request.form["email"].strip().lower()
        password = request.form["password"]

        existing = User.query.filter_by(email=email).first()
        if existing:
            flash("An account with this email already exists. Please log in.", "warning")
            return redirect(url_for("login"))
        
        user = User(
            first_name=first_name,
            last_name=last_name,
            email=email,
            password_hash=generate_password_hash(password),
            role="member"
        )
        db.session.add(user)
        db.session.commit()

        flash("Account created. Please log in.", "success")
        return redirect(url_for("login"))
    return render_template("auth/register.html")

@app.route("/login", methods=["GET", "POST"])
def login():
    if request.method == "POST":
        email = request.form["email"].strip().lower()
        password = request.form["password"]

        user = User.query.filter_by(email=email).first()
        if user and check_password_hash(user.password_hash, password):
            session["user"] = user.email
            session["role"] = user.role
            log_action(
                "LOGIN",
                user=user
            )

            flash("Logged in successfully.", "success")
            return redirect(url_for("home"))
        flash("Invalid email or password, please try again.", "danger")
        return redirect(url_for("login"))
    return render_template("auth/login.html")

@app.route("/logout")
def logout():
    session.pop("user", None)
    session.pop("role", None)

    flash("Successfully logged out, see you soon.", "info")
    return redirect(url_for("home"))

from sqlalchemy import func

@app.route("/")
def home():
    user = get_current_user()

    upcoming_events = (
        Event.query
        .filter(Event.start_time >= datetime.now(timezone.utc).replace(tzinfo=None))
        .order_by(Event.start_time.asc())
        .limit(6)
        .all()
    )

    recent_logs = []
    committee_rows = []
    my_rsvps_preview = []

    if user and user.role == "admin":
        try:
            logs_stream = (
                firestore_db.collection("activity_logs")
                .order_by("timestamp", direction=firestore.Query.DESCENDING)
                .limit(5)
                .stream()
            )
            recent_logs = [doc.to_dict() for doc in logs_stream]
        except Exception:
            recent_logs = []

    if user and user.role in ["committee", "admin"]:
        committee_rows = (
            db.session.query(
                Event,
                func.count(RSVP.user_id).label("going_count")
            )
            .outerjoin(RSVP, and_(RSVP.event_id == Event.id, RSVP.status == "going"))
            .filter(Event.start_time >= datetime.now(timezone.utc).replace(tzinfo=None))
            .group_by(Event.id)
            .order_by(Event.start_time.asc())
            .limit(6)
            .all()
        )

    if user:
        my_rsvps_preview = (
            db.session.query(Event)
            .join(RSVP, RSVP.event_id == Event.id)
            .filter(RSVP.user_id == user.id, RSVP.status == "going")
            .order_by(Event.start_time.asc())
            .limit(4)
            .all()
        )

    return render_template(
        "home/home.html",
        upcoming_events=upcoming_events,
        recent_logs=recent_logs,
        committee_rows=committee_rows,
        my_rsvps_preview=my_rsvps_preview
    )


# -----------------------------------------------------------------------------------
# Routes: Events & My RSVPs (public/member view)
# -----------------------------------------------------------------------------------

@app.route("/events")
def list_events():
    events = Event.query.order_by(Event.start_time.asc()).all()
    return render_template("events/list.html", events=events)

@app.route("/events/<int:event_id>")
def event_detail(event_id):
    event = Event.query.get_or_404(event_id)
    user = get_current_user()

    existing_rsvp = None
    if user:
        existing_rsvp = RSVP.query.filter_by(user_id=user.id, event_id=event.id).first()

    back_url = safe_referrer(url_for("list_events"))

    feedback_items = []
    if firestore_db and session.get("role") in ["committee", "admin"]:
        try:
            snaps = firestore_db.collection("event_feedback") \
                .document(str(event_id)) \
                .collection("items") \
                .order_by("created_at", direction=firestore.Query.DESCENDING) \
                .limit(10) \
                .stream()
            feedback_items = [s.to_dict() for s in snaps]
        except Exception:
            feedback_items = []

    return render_template("events/detail.html", event=event, existing_rsvp=existing_rsvp, back_url=back_url, feedback_items=feedback_items)

@app.post("/events/<int:event_id>/feedback")
@csrf.exempt
@login_required
def submit_feedback(event_id):
    if not firestore_db:
        abort(503)

    event = Event.query.get_or_404(event_id)
    rating = int(request.form.get("rating", "0"))
    comment = (request.form.get("comment") or "").strip()

    if rating < 1 or rating > 5:
        flash("Rating must be between 1 and 5.", "danger")
        return redirect(url_for("event_detail", event_id=event_id))

    if len(comment) > 500:
        flash("Comment is too long (max 500 chars).", "danger")
        return redirect(url_for("event_detail", event_id=event_id))

    user = get_current_user()

    firestore_db.collection("event_feedback") \
        .document(str(event_id)) \
        .collection("items") \
        .add({
            "event_id": event_id,
            "user_email": user.email,
            "rating": rating,
            "comment": comment,
            "created_at": firestore.SERVER_TIMESTAMP,
        })

    flash("Thanks! Your feedback was submitted.", "success")
    return redirect(url_for("event_detail", event_id=event_id))


@app.route("/my-rsvps")
@login_required
def my_rsvps():
    user = get_current_user()
    rows = (
        db.session.query(RSVP, Event)
        .join(Event, RSVP.event_id == Event.id)
        .filter(RSVP.user_id == user.id, RSVP.status == "going")
        .order_by(Event.start_time.asc())
        .all()
    )

    return render_template("events/my_rsvps.html", rows=rows)


# -----------------------------------------------------------------------------------
# Routes: Events (committee/admin view)
# -----------------------------------------------------------------------------------

@app.route("/admin/events/new", methods=["GET", "POST"])
@csrf.exempt
@committee_or_admin_required
def admin_event_new():
    if request.method == "POST":
        title = request.form["title"].strip()
        description = request.form.get("description", "").strip()
        location = request.form.get("location", "").strip()
        start_time = parse_dt_local(request.form["start_time"])
        end_time = parse_dt_local(request.form["end_time"])
        creator = get_current_user()
        image_file = request.files.get("image")
        image_url = upload_event_image(image_file) if image_file and image_file.filename else None

        if end_time <= start_time:
            flash("End time must be after start time.", "danger")
            return redirect(request.url)

        event = Event(
            title=title,
            description=description,
            location=location,
            start_time=start_time,
            end_time=end_time,
            created_by=creator.id,
            image_url=image_url
        )

        db.session.add(event)
        db.session.commit()
        mirror_event_to_firestore(event)

        return redirect(url_for("list_events"))
    return render_template("events/form.html", mode="create")

@app.route("/admin/events/<int:event_id>/edit", methods=["GET", "POST"])
@csrf.exempt
@committee_or_admin_required
def admin_event_edit(event_id):
    event = Event.query.get_or_404(event_id)

    if request.method == "POST":
        event.title = request.form["title"].strip()
        event.description = request.form.get("description", "").strip()
        event.location = request.form.get("location", "").strip()
        event.start_time = datetime.fromisoformat(request.form["start_time"])
        event.end_time = datetime.fromisoformat(request.form["end_time"])

        image_file = request.files.get("image")
        if image_file and image_file.filename:
            event.image_url = upload_event_image(image_file)

        db.session.commit()
        mirror_event_to_firestore(event)

        return redirect(url_for("event_detail", event_id=event.id))
    return render_template("events/form.html", mode="edit", event=event)

@app.route("/admin/events/<int:event_id>/delete", methods=["POST"])
@csrf.exempt
@committee_or_admin_required
def admin_event_delete(event_id):
    event = Event.query.get_or_404(event_id)

    RSVP.query.filter_by(event_id=event.id).delete()
    db.session.delete(event)
    db.session.commit()
    delete_event_mirror(event_id)

    return redirect(url_for("list_events"))


# -----------------------------------------------------------------------------------
# Routes: RSVP actions (all view)
# -----------------------------------------------------------------------------------

@app.route("/events/<int:event_id>/rsvp", methods=["POST"])
@csrf.exempt
@login_required
def toggle_rsvp(event_id):
    user = get_current_user()
    event = Event.query.get_or_404(event_id)

    action = request.form.get("action")
    is_going = (action == "going")

    rsvp = RSVP.query.filter_by(user_id=user.id, event_id=event.id).first()
    if rsvp:
        rsvp.status = "going" if is_going else "cancelled"
        update_event_stats_firestore(event.id, -1)
    else:
        rsvp = RSVP(
            user_id=user.id,
            event_id=event.id,
            status="going" if is_going else "cancelled"
        )
        update_event_stats_firestore(event.id, +1)
        db.session.add(rsvp)
        
    db.session.commit()
    call_rsvp_cloud_function(user, event, rsvp.status)
    log_action(
        "RSVP_UPDATED",
        user=user,
        extra={
            "event_id": event.id,
            "event_title": event.title,
            "new_status": rsvp.status
        }
    )

    return redirect(url_for("event_detail", event_id=event.id))


# -----------------------------------------------------------------------------------
# Routes: RSVP actions (committee/admin view)
# -----------------------------------------------------------------------------------

@app.route("/events/<int:event_id>/rsvps")
@committee_or_admin_required
def event_rsvps(event_id):
    event = Event.query.get_or_404(event_id)

    rows = (
        db.session.query(User, RSVP)
        .join(RSVP, RSVP.user_id == User.id)
        .filter(RSVP.event_id == event.id, RSVP.status == "going")
        .order_by(User.first_name.asc(), User.last_name.asc())
        .all()
    )

    return render_template("events/rsvps_list.html", event=event, rows=rows)


# -----------------------------------------------------------------------------------
# Routes: REST APIs
# -----------------------------------------------------------------------------------

@app.route("/api/events")
@csrf.exempt
def api_events():
    events = Event.query.order_by(Event.start_time.asc()).all()
    return {
        "events": [
            {
                "id": event.id,
                "title": event.title,
                "description": event.description,
                "location": event.location,
                "start_time": event.start_time.isoformat(),
                "end_time": event.end_time.isoformat()
            }
            for event in events
        ]
    }

@app.route("/api/events/<int:event_id>/rsvp", methods=["POST"])
@csrf.exempt
@login_required
def api_toggle_rsvp(event_id):
    user = get_current_user()
    event = Event.query.get_or_404(event_id)

    body = request.get_json(silent=True) or {}
    is_going = bool(body.get("going", False))

    rsvp = RSVP.query.filter_by(user_id=user.id, event_id=event.id).first()

    if rsvp:
        rsvp.status = "going" if is_going else "cancelled"
    else:
        rsvp = RSVP(
            user_id=user.id,
            event_id=event.id,
            status="going" if is_going else "cancelled"
        )
        db.session.add(rsvp)

    db.session.commit()
    call_rsvp_cloud_function(user, event, rsvp.status)

    return {
        "message": "RSVP updated",
        "event_id": event.id,
        "status": rsvp.status
    }, 200


# -----------------------------------------------------------------------------------
# Routes: Main
# -----------------------------------------------------------------------------------

if __name__ == "__main__":
    app.run(debug=True)