app.py

from fastapi import FastAPI, HTTPException, Query, Header
from fastapi.middleware.cors import CORSMiddleware
from fastapi.responses import JSONResponse, FileResponse
from typing import Optional
from dotenv import load_dotenv
from database import init_db, DB_PATH
from models import UserCreate, UserLogin, SessionCreate, ABADetails, KidDetails, TherapistKid
from crud import (
    create_user, get_user_by_email, create_session,
    create_aba_entry, create_kid_entry, get_user_sessions,
    get_kid_data_by_user, get_kid_by_nickname_full as get_kid_by_nickname,
    nickname_exists, get_sessions_by_therapist_and_nickname,
    get_sessions_by_nickname, link_therapist_to_kid,
    get_kids_by_therapist, get_therapists_by_kid,
    get_user_by_id
)
import os

# Carrega variáveis de ambiente (.env em local, variáveis em HF Spaces)
if os.getenv("HF_SPACE") is None:
    load_dotenv()

API_BACKUP_TOKEN = os.getenv("API_BACKUP_TOKEN")

app = FastAPI()
init_db()

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

@app.post("/register")
def register(user: UserCreate):
    if get_user_by_email(user.email):
        raise HTTPException(status_code=400, detail="Email já registrado.")
    create_user(user.name, user.email, user.password, user.role)
    return {"message": "Usuário registrado com sucesso!"}

@app.post("/login")
def login(user: UserLogin):
    db_user = get_user_by_email(user.email)
    if db_user and db_user[3] == user.password:
        return {"message": "Login bem-sucedido!", "user_id": db_user[0], "role": db_user[4]}
    raise HTTPException(status_code=401, detail="Credenciais inválidas.")

@app.post("/sessions")
def add_session(session: SessionCreate):
    session_id = create_session(session)
    return {"message": session_id}

@app.post("/aba")
def add_aba_data(data: ABADetails):
    create_aba_entry(data)
    return {"message": "Dados ABA registrados!"}

@app.post("/kid")
def add_kid_data(data: KidDetails):
    create_kid_entry(data)
    return {"message": "Dados da criança registrados!"}

@app.get("/kid/by-user/{user_id}")
def get_kid_by_user(user_id: int):
    try:
        data = get_kid_data_by_user(user_id)
        keys = ["id", "user_id", "nickname", "age", "suport_level"]
        dict_data = [dict(zip(keys, row)) for row in data]
        return JSONResponse(content=dict_data)
    except Exception as e:
        raise HTTPException(status_code=500, detail=str(e))

@app.get("/kid/by-nickname/{nickname}")
def get_kid_by_nickname_endpoint(nickname: str):
    try:
        data = get_kid_by_nickname(nickname)
        return JSONResponse(content=data)
    except Exception as e:
        raise HTTPException(status_code=500, detail=str(e))

@app.get("/sessions/by-therapist-and-nickname")
def get_sessions_by_therapist_and_nickname_endpoint(
    user_id: int = Query(...),
    nickname: str = Query(...)
):
    try:
        data = get_sessions_by_therapist_and_nickname(user_id, nickname)
        return JSONResponse(content=data)
    except Exception as e:
        raise HTTPException(status_code=500, detail=str(e))

@app.get("/sessions/{user_id}")
def get_sessions(user_id: int, start_date: Optional[str] = None, end_date: Optional[str] = None):
    try:
        sessions = get_user_sessions(user_id, start_date, end_date)
        return JSONResponse(content=sessions)
    except Exception as e:
        raise HTTPException(status_code=500, detail=str(e))

@app.get("/sessions/{user_id}/latest")
def get_latest_sessions(user_id: int):
    try:
        sessions = get_user_sessions(user_id, limit=5)
        keys = ["id", "user_id", "date", "activities", "progress", "challenges", "observations", "performance_score", "fails_score", "task_completion", "behavior_rating"]
        session_dicts = [dict(zip(keys, row)) for row in sessions]
        return JSONResponse(content=session_dicts)
    except Exception as e:
        raise HTTPException(status_code=500, detail=str(e))

@app.post("/therapist/kid")
def link_kid(data: TherapistKid):
    link_therapist_to_kid(data)
    return {"message": "Criança vinculada ao terapeuta com sucesso."}

@app.get("/therapist/kids/{user_id}")
def get_kids(user_id: int):
    return get_kids_by_therapist(user_id)

@app.get("/therapist/kids-by-nickname/{nickname}")
def get_therapists_by_kid_nickname(nickname: str):
    try:
        data = get_therapists_by_kid(nickname)
        return JSONResponse(content=data)
    except Exception as e:
        raise HTTPException(status_code=500, detail=str(e))

@app.get("/kid/check-nickname/{nickname}")
def check_kid_nickname(nickname: str):
    exists = nickname_exists(nickname)
    return {"exists": exists}

@app.get("/sessions/by-nickname/{nickname}")
def get_sessions_by_nickname_endpoint(nickname: str):
    try:
        data = get_sessions_by_nickname(nickname)
        return JSONResponse(content=data)
    except Exception as e:
        raise HTTPException(status_code=500, detail=str(e))

@app.get("/user/{user_id}")
def get_user_by_id_endpoint(user_id: int):
    user = get_user_by_id(user_id)
    if user:
        return {"user_id": user[0], "name": user[1], "email": user[2], "role": user[4]}
    raise HTTPException(status_code=404, detail="Usuário não encontrado.")

# 🔐 Endpoint de backup protegido por token e verificação de admin
@app.get("/backup/db")
def download_database(
    authorization: str = Header(None),
    user_id: int = Query(...)
):
    if authorization != f"Bearer {API_BACKUP_TOKEN}":
        raise HTTPException(status_code=401, detail="Token inválido.")

    user = get_user_by_id(user_id)
    if not user or user["role"].lower() != "admin":
        raise HTTPException(status_code=403, detail="Acesso restrito a administradores.")

    try:
        return FileResponse(
            path=DB_PATH,
            filename="aba_data_backup.db",
            media_type="application/octet-stream"
        )
    except Exception as e:
        raise HTTPException(status_code=500, detail=f"Erro ao baixar o banco de dados: {str(e)}")