from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.orm import Session

from database import get_db
from model.admin import Admin
from core.security import verify_password
from schemas import AdminLogin, AdminOut

router = APIRouter(prefix="/admin", tags=["Admin Auth"])


@router.post("/login", response_model=AdminOut)
def admin_login(payload: AdminLogin, db: Session = Depends(get_db)):
    admin = db.query(Admin).filter(Admin.username == payload.username).first()

    if not admin or not verify_password(payload.password, admin.password):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid username or password",
        )

    # NOTE: no session/JWT yet — this just validates credentials.
    # Token-based route protection is the next step.
    return admin