"""MCP Auth Admin — FastAPI 主入口

鉴权统一走鼎捷云 IAM：请求头 digi-middleware-auth-user / digi-middleware-auth-app
经 IAM /api/iam/v2/identity/token/analyze 校验。
静态文件由前端构建产物提供（STATIC_DIR 指向）。
"""

from contextlib import asynccontextmanager
from pathlib import Path

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from fastapi.staticfiles import StaticFiles

from app.core.config import settings
from app.core.db import close_pool, get_pool
from app.core.iam import close_iam_client
from app.core.redis import close_redis
from app.routers import auth, services, stats, tokens, verify


@asynccontextmanager
async def lifespan(app: FastAPI):
    await get_pool()
    yield
    await close_pool()
    await close_iam_client()
    await close_redis()


app = FastAPI(
    title="MCP Auth Admin",
    description="MCP 服务 Bearer Token 动态鉴权管理后台",
    version="1.0.0",
    # 反向代理路径前缀：带前缀的外层 nginx（如 /mcp-auth-api）后，
    # OpenAPI servers 与 Swagger 加载的 openapi.json 会带上该前缀，文档才能正确渲染
    root_path=settings.ROOT_PATH,
    lifespan=lifespan,
)

# CORS（开发期前端 dev server 跨域；生产同源可不配）
app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

# API 路由
app.include_router(auth.router)
app.include_router(tokens.router)
app.include_router(services.router)
app.include_router(stats.router)
app.include_router(verify.router)


@app.get("/api/health")
async def health():
    return {"status": "ok"}


# 静态文件（前端构建产物），必须在所有 API 路由之后挂载
static_dir = Path(settings.STATIC_DIR)
if static_dir.exists():
    app.mount("/", StaticFiles(directory=str(static_dir), html=True), name="static")