"""FastAPI app for the yunke data-mirror viewing API.

Run locally with::

    uvicorn app.api.main:app --reload

Includes:
* ``GET /api/health``  -> ``{"status": "ok"}`` liveness probe.
* ``GET /api/customers`` (see :mod:`app.api.routers.customer`).
* ``GET /api/media/{media_hash}`` (see :mod:`app.api.routers.media`).
* ``GET /api/departments`` / ``/api/staff`` / ``/api/accounts``
  (see :mod:`app.api.routers.organization`).
* ``GET /api/messages`` (see :mod:`app.api.routers.messages`).
* ``GET /api/moments`` (see :mod:`app.api.routers.moments`).
* ``GET /api/groups`` / ``/api/groups/{room_id}/members``
  (see :mod:`app.api.routers.groups`).
* ``GET /api/calls`` (see :mod:`app.api.routers.calls`).
* ``GET /api/sms`` (see :mod:`app.api.routers.sms`).
* ``GET /api/voice-clips`` (see :mod:`app.api.routers.voice_clips`).
* ``GET /api/sync/status`` (see :mod:`app.api.routers.sync`).
* ``GET /api/search`` (see :mod:`app.api.routers.search`).
* ``GET /api/export/chat-html`` (see :mod:`app.api.routers.export`).
* ``GET /api/staff-stats`` (see :mod:`app.api.routers.staff_stats`).

CORS is configured to read explicit allowed origins from ``Settings.cors_origins``
(comma-separated ``CORS_ORIGINS`` env var). Empty (default) falls back to the dev
origin ``http://localhost:5173``; set ``CORS_ORIGINS=https://app.example.com`` in
prod. Never wildcard — see the comment near ``add_middleware`` below.

Auth (Task 2.9): a single shared-token dependency (:func:`app.api.auth.require_auth`)
is applied globally on the app. Trust model: when ``Settings.api_token`` is
empty (the default) auth is disabled — we trust the network boundary (this is a
local/intranet tool). When a token is configured, every request must present it
via ``Authorization: Bearer <token>`` or ``?token=``. ``/api/health`` is exempt
so liveness probes work without the token. See :mod:`app.api.auth`.
"""

from __future__ import annotations

from fastapi import Depends, FastAPI
from fastapi.middleware.cors import CORSMiddleware

from app.api.auth import require_auth
from app.api.routers import (
    calls,
    customer,
    export,
    groups,
    media,
    messages,
    moments,
    organization,
    search,
    sessions,
    sms,
    staff_chat_stats,
    staff_stats,
    sync,
    voice_clips,
)
from app.config import get_settings

app = FastAPI(title="yunke data mirror", dependencies=[Depends(require_auth)])

# CORS: read explicit allowed origins from Settings (``CORS_ORIGINS`` env var,
# comma-separated). Empty -> dev fallback (``http://localhost:5173``). Never
# ``*`` — wildcard CORS on an authenticated API is an open door even without
# credentials, since the middleware would reflect any attacker-controlled
# origin back in ``Access-Control-Allow-Origin``.
_settings = get_settings()
_cors = _settings.cors_origins.strip()
if _cors:
    _origins = [o.strip() for o in _cors.split(",") if o.strip()]
else:
    _origins = []  # empty = deny all cross-origin (safest default)
app.add_middleware(
    CORSMiddleware,
    allow_origins=_origins or ["http://localhost:5173"],  # dev fallback
    allow_methods=["GET", "PATCH", "POST"],
    allow_headers=["*"],
    allow_credentials=False,
)

app.include_router(customer.router)
app.include_router(media.router)
app.include_router(organization.router)
app.include_router(messages.router)
app.include_router(moments.router)
app.include_router(groups.router)
app.include_router(calls.router)
app.include_router(sms.router)
app.include_router(staff_chat_stats.router)
app.include_router(staff_stats.router)
app.include_router(sync.router)
app.include_router(search.router)
app.include_router(sessions.router)
app.include_router(export.router)
app.include_router(voice_clips.router)


@app.get("/api/health")
async def health() -> dict[str, str]:
    """Trivial liveness probe."""
    return {"status": "ok"}