"""
Lazy singleton Supabase client.

The backend authenticates with the service_role key (bypasses RLS),
which is safe because the key never leaves the server. The browser /
frontend should use the anon (or publishable) key with RLS policies —
see supabase/schema.sql.
"""
import httpx
import structlog

from ..config import settings

logger = structlog.get_logger()

_client = None


def get_supabase():
    """Return the shared Supabase client, creating it on first use."""
    global _client
    if _client is None:
        if not settings.supabase_configured:
            raise RuntimeError(
                "Supabase is not configured. Set SUPABASE_URL and "
                "SUPABASE_SERVICE_ROLE_KEY in the backend .env file."
            )
        from supabase import create_client

        _client = create_client(settings.supabase_url, settings.supabase_service_role_key)
        logger.info("supabase_client_created", url=settings.supabase_url)
    return _client


def reset_supabase():
    """Drop the cached client (useful in tests)."""
    global _client
    _client = None


async def supabase_ping() -> dict:
    """
    Verify Supabase connectivity and schema readiness.

    Returns a dict:
      {configured, reachable, tables_ready, detail}

    reachable    -> REST API answered with the service-role key
    tables_ready -> public.validation_results exists (schema applied)
    """
    if not settings.supabase_configured:
        return {
            "configured": False,
            "reachable": False,
            "tables_ready": False,
            "detail": "Supabase not configured (SUPABASE_URL / SUPABASE_SERVICE_ROLE_KEY)",
        }

    try:
        async with httpx.AsyncClient(timeout=10) as client:
            resp = await client.get(
                f"{settings.supabase_url.rstrip('/')}/rest/v1/validation_results",
                headers={
                    "apikey": settings.supabase_service_role_key,
                    "Authorization": f"Bearer {settings.supabase_service_role_key}",
                    "Range": "0-0",
                },
                params={"select": "id"},
            )
    except httpx.HTTPError as exc:
        return {
            "configured": True,
            "reachable": False,
            "tables_ready": False,
            "detail": f"Network error: {exc}",
        }

    if resp.status_code == 200:
        return {"configured": True, "reachable": True, "tables_ready": True,
                "detail": "Connected — schema ready"}
    if resp.status_code == 404:
        return {"configured": True, "reachable": True, "tables_ready": False,
                "detail": "Connected but schema missing — run supabase/schema.sql "
                          "in the Supabase SQL editor"}
    if resp.status_code == 401:
        return {"configured": True, "reachable": True, "tables_ready": False,
                "detail": "Service-role key rejected (401)"}
    return {"configured": True, "reachable": True, "tables_ready": False,
            "detail": f"Unexpected response {resp.status_code}"}