"""Globale Passwortrichtlinie – lesen für jeden, ändern nur für Admins.

Lesbar muss sie für alle sein, weil die Anforderungs-Checkliste beim
Passwortsetzen dieselben Werte braucht.
"""

from fastapi import APIRouter, Depends
from sqlalchemy.orm import Session

from ..database import get_db
from ..deps import get_current_user, require_admin
from ..models import User
from ..schemas import PolicyIn, PolicyOut
from ..services import policy as policy_service

router = APIRouter(prefix="/policy", tags=["policy"])


@router.get("", response_model=PolicyOut)
def get_policy(
    db: Session = Depends(get_db), _: User = Depends(get_current_user)
) -> PolicyOut:
    return PolicyOut(**policy_service.load(db).as_dict())


@router.put("", response_model=PolicyOut)
def set_policy(
    payload: PolicyIn,
    db: Session = Depends(get_db),
    _: User = Depends(require_admin),
) -> PolicyOut:
    saved = policy_service.save(db, policy_service.Policy(**payload.model_dump()))
    return PolicyOut(**saved.as_dict())