from datetime import UTC, datetime

from fastapi import HTTPException
from pydantic import ValidationError
from sqlalchemy.ext.asyncio import AsyncSession

from core.secrets import decode_jwt
from repositories.users import UserRepository
from schemas.dto import AuthContext
from schemas.jwt import JWTPayload


async def authorize(token: str, session: AsyncSession, service: str | None = None) -> AuthContext:
    content = decode_jwt(token)

    try:
        payload = JWTPayload.model_validate(content)
    except ValidationError:
        raise HTTPException(status_code=401, detail="Invalid credentials") from None

    if payload.exp < datetime.now(UTC).timestamp():
        raise HTTPException(status_code=401, detail="Access token expired")

    repo = UserRepository(session)
    user = await repo.get_user_by_id(int(payload.sub))

    if not user:
        raise HTTPException(status_code=401, detail="User not found")

    return AuthContext(user, auth_method="jwt", service=service)