#Data verification: Build a secure line of defense for Flask user interaction

from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, IntegerField, TextAreaField
from wtforms.validators import (
    DataRequired, Email, Length, EqualTo,
    Regexp, URL, NumberRange, Optional
)


class ArticleSubmissionForm(FlaskForm):
    # 标题：必填、5-100 字符、仅允许中文/英文/数字/下划线/空格
    title = StringField(
        "投稿标题",
        validators=[
            DataRequired(message="标题可不能空着哦😯"),
            Length(
                min=5, max=100,
                message="标题太长太短都不行，请控制在 5-100 个字符之间"
            ),
            Regexp(
                r"^[\u4e00-\u9fa5a-zA-Z0-9_ ]+$",
                message="标题只能包含中文、英文字母、数字、下划线和空格"
            ),
        ],
    )

    # URL 别名：必填、5-50 字符、仅允许小写字母/数字/连字符（SEO 友好）
    url_slug = StringField(
        "URL 别名（用于生成链接）",
        validators=[
            DataRequired(),
            Length(max=50, message="URL 别名太长啦，不利于分享"),
            Regexp(
                r"^[a-z0-9-]+$",
                message="只能用小写字母、数字和连字符哦"
            ),
        ],
    )

    # 作者年龄：可选、18-100 岁
    author_age = IntegerField(
        "您的年龄（选填）",
        validators=[
            Optional(),
            NumberRange(
                min=18, max=100,
                message="如果填写年龄，请确保是 18-100 岁之间的有效数字"
            ),
        ],
    )

    # 个人博客：可选、仅允许 http/https 开头
    personal_blog = StringField(
        "个人博客链接（选填）",
        validators=[
            Optional(),
            URL(message="请输入有效的博客链接，记得加上 http:// 或 https:// 前缀"),
        ],
    )

# 中国手机号验证
phone = StringField(
    "手机号",
    validators=[
        Regexp(
            r"^1[3-9]\d{9}$",
            message="请输入 11 位有效的中国手机号"
        ),
    ],
)

# 合规用户名（字母开头、字母数字下划线、3-20 位）
username = StringField(
    "用户名",
    validators=[
        Regexp(
            r"^[a-zA-Z]\w{2,19}$",
            message="用户名需以字母开头，3-20 个字符，仅允许字母、数字和下划线"
        ),
    ],
)

# 假设已定义 User 模型和 db 实例
# from app.models import User
# from app import db

class SignUpForm(FlaskForm):
    username = StringField("用户名", validators=[
        DataRequired(), Length(3, 20),
    ])
    bio = TextAreaField("个人简介", validators=[
        Length(max=200, message="简介最多 200 个字符"),
    ])

    # 同时检查敏感词和唯一性
    def validate_username(self, field):
        sensitive_words = ["admin", "root", "system", "test"]
        if any(word in field.data.lower() for word in sensitive_words):
            raise ValidationError("该用户名太敏感啦，换一个试试😉")

        if User.query.filter_by(username=field.data).first():
            raise ValidationError("这个用户名已经被别人注册了哦")

    # 简介里禁止出现外部链接
    def validate_bio(self, field):
        if field.data and ("http://" in field.data.lower() or "https://" in field.data.lower()):
            raise ValidationError("为了社区安全，简介中暂时禁止添加链接")

# app/validators.py
import re
from wtforms.validators import ValidationError


# 通用敏感词检查
def no_common_sensitive_words(form, field):
    """检查文本是否包含通用敏感词（示例列表）"""
    sensitive_words = ["诈骗", "赌博", "色情"]
    if any(word in field.data for word in sensitive_words):
        raise ValidationError("文本中包含违规内容，请修改后再提交")


# 通用外部链接禁止
def no_external_links(form, field):
    """检查文本是否包含以 http/https 开头的外部链接"""
    url_pattern = r"https?://[^\s]+"
    if re.search(url_pattern, field.data, re.IGNORECASE):
        raise ValidationError("文本中暂时禁止添加外部链接")

from app.validators import no_common_sensitive_words, no_external_links

class CommentForm(FlaskForm):
    content = TextAreaField("评论内容", validators=[
        DataRequired(), Length(1, 500),
        no_common_sensitive_words, no_external_links,
    ])

# app/routes/api.py
from flask import Blueprint, jsonify
from app.models import User

api_bp = Blueprint("api", __name__, url_prefix="/api")


@api_bp.route("/check/username/<username>")
def check_username(username):
    exists = User.query.filter_by(username=username).first() is not None
    return jsonify({"available": not exists, "username": username})


@api_bp.route("/check/email/<email>")
def check_email(email):
    import re
    if not re.match(r"^[\w\.-]+@[\w\.-]+\.\w+$", email):
        return jsonify({"valid": False, "available": False})
    exists = User.query.filter_by(email=email).first() is not None
    return jsonify({"valid": True, "available": not exists})