ariadne/ariadne/app.py

from __future__ import annotations

from dataclasses import dataclass
from datetime import datetime, timezone
import json
import threading
from typing import Any, Callable

from fastapi import Body, Depends, FastAPI, HTTPException, Request
from fastapi.responses import JSONResponse, Response
from prometheus_client import CONTENT_TYPE_LATEST, generate_latest

from .auth.keycloak import AuthContext, authenticator
from .db.database import Database, DatabaseConfig
from .db.storage import Storage, TaskRunRecord
from .manager.provisioning import ProvisioningManager
from .metrics.metrics import record_task_run
from .scheduler.cron import CronScheduler
from .services.comms import comms
from .services.firefly import firefly
from .services.keycloak_admin import keycloak_admin
from .services.keycloak_profile import run_profile_sync
from .services.mailu import mailu
from .services.mailu_events import mailu_events
from .services.nextcloud import nextcloud
from .services.image_sweeper import image_sweeper
from .services.opensearch_prune import prune_indices
from .services.pod_cleaner import clean_finished_pods
from .services.vaultwarden_sync import run_vaultwarden_sync
from .services.vault import vault
from .services.wger import wger
from .settings import settings
from .utils.errors import safe_error_detail
from .utils.http import extract_bearer_token
from .utils.logging import LogConfig, configure_logging, get_logger, task_context
from .utils.passwords import random_password


configure_logging(LogConfig(level=settings.log_level))
logger = get_logger(__name__)


@dataclass(frozen=True)
class AccountTaskContext:
    task_name: str
    username: str
    started: datetime
    extra: dict[str, Any] | None = None


@dataclass(frozen=True)
class PasswordResetRequest:
    task_name: str
    service_label: str
    username: str
    mailu_email: str
    password: str
    sync_fn: Callable[[], dict[str, Any]]
    password_attr: str
    updated_attr: str
    error_hint: str

portal_db = Database(
    settings.portal_database_url,
    DatabaseConfig(
        pool_min=settings.ariadne_db_pool_min,
        pool_max=settings.ariadne_db_pool_max,
        connect_timeout_sec=settings.ariadne_db_connect_timeout_sec,
        lock_timeout_sec=settings.ariadne_db_lock_timeout_sec,
        statement_timeout_sec=settings.ariadne_db_statement_timeout_sec,
        idle_in_tx_timeout_sec=settings.ariadne_db_idle_in_tx_timeout_sec,
        application_name="ariadne_portal",
    ),
)
ariadne_db = Database(
    settings.ariadne_database_url,
    DatabaseConfig(
        pool_min=settings.ariadne_db_pool_min,
        pool_max=settings.ariadne_db_pool_max,
        connect_timeout_sec=settings.ariadne_db_connect_timeout_sec,
        lock_timeout_sec=settings.ariadne_db_lock_timeout_sec,
        statement_timeout_sec=settings.ariadne_db_statement_timeout_sec,
        idle_in_tx_timeout_sec=settings.ariadne_db_idle_in_tx_timeout_sec,
        application_name="ariadne",
    ),
)
storage = Storage(ariadne_db, portal_db)
provisioning = ProvisioningManager(portal_db, storage)
scheduler = CronScheduler(storage, settings.schedule_tick_sec)


def _record_event(event_type: str, detail: dict[str, Any] | str | None) -> None:
    try:
        storage.record_event(event_type, detail)
    except Exception:
        pass


def _parse_event_detail(detail: str | None) -> Any:
    if not isinstance(detail, str) or not detail:
        return ""
    try:
        return json.loads(detail)
    except Exception:
        return detail


app = FastAPI(title=settings.app_name)


def _require_auth(request: Request) -> AuthContext:
    token = extract_bearer_token(request)
    if not token:
        raise HTTPException(status_code=401, detail="missing bearer token")
    try:
        return authenticator.authenticate(token)
    except Exception:
        raise HTTPException(status_code=401, detail="invalid token")


def _require_admin(ctx: AuthContext) -> None:
    if ctx.username and ctx.username in settings.portal_admin_users:
        return
    if settings.portal_admin_groups and set(ctx.groups).intersection(settings.portal_admin_groups):
        return
    raise HTTPException(status_code=403, detail="forbidden")


def _require_account_access(ctx: AuthContext) -> None:
    if not settings.account_allowed_groups:
        return
    if not ctx.groups:
        return
    if set(ctx.groups).intersection(settings.account_allowed_groups):
        return
    raise HTTPException(status_code=403, detail="forbidden")


async def _read_json_payload(request: Request) -> dict[str, Any]:
    try:
        payload = await request.json()
    except Exception:
        return {}
    return payload if isinstance(payload, dict) else {}


def _note_from_payload(payload: dict[str, Any]) -> str | None:
    note = payload.get("note") if isinstance(payload, dict) else None
    return str(note).strip() if isinstance(note, str) and note.strip() else None


def _flags_from_payload(payload: dict[str, Any]) -> list[str]:
    flags_raw = payload.get("flags") if isinstance(payload, dict) else None
    return [flag for flag in flags_raw if isinstance(flag, str)] if isinstance(flags_raw, list) else []


def _allowed_flag_groups() -> list[str]:
    if not keycloak_admin.ready():
        return settings.allowed_flag_groups
    try:
        return keycloak_admin.list_group_names(exclude={"admin"})
    except Exception:
        return settings.allowed_flag_groups


def _resolve_mailu_email(username: str) -> str:
    mailu_email = f"{username}@{settings.mailu_domain}"
    try:
        user = keycloak_admin.find_user(username) or {}
        attrs = user.get("attributes") if isinstance(user, dict) else None
        if isinstance(attrs, dict):
            raw_mailu = attrs.get("mailu_email")
            if isinstance(raw_mailu, list) and raw_mailu:
                return str(raw_mailu[0])
            if isinstance(raw_mailu, str) and raw_mailu:
                return raw_mailu
    except Exception:
        return mailu_email
    return mailu_email


def _record_account_task(ctx: AccountTaskContext, status: str, error_detail: str) -> None:
    finished = datetime.now(timezone.utc)
    duration_sec = (finished - ctx.started).total_seconds()
    record_task_run(ctx.task_name, status, duration_sec)
    try:
        storage.record_task_run(
            TaskRunRecord(
                request_code=None,
                task=ctx.task_name,
                status=status,
                detail=error_detail or None,
                started_at=ctx.started,
                finished_at=finished,
                duration_ms=int(duration_sec * 1000),
            )
        )
    except Exception:
        pass
    detail = {"username": ctx.username, "status": status, "error": error_detail}
    if ctx.extra:
        detail.update(ctx.extra)
    _record_event(ctx.task_name, detail)


def _run_password_reset(request: PasswordResetRequest) -> JSONResponse:
    started = datetime.now(timezone.utc)
    task_ctx = AccountTaskContext(
        task_name=request.task_name,
        username=request.username,
        started=started,
        extra={"mailu_email": request.mailu_email},
    )
    status = "ok"
    error_detail = ""
    logger.info(
        f"{request.service_label} password reset requested",
        extra={"event": request.task_name, "username": request.username},
    )
    try:
        result = request.sync_fn()
        status_val = result.get("status") if isinstance(result, dict) else "error"
        if status_val != "ok":
            raise RuntimeError(f"{request.service_label} sync {status_val}")

        keycloak_admin.set_user_attribute(
            request.username,
            request.password_attr,
            request.password,
        )
        keycloak_admin.set_user_attribute(
            request.username,
            request.updated_attr,
            datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
        )

        logger.info(
            f"{request.service_label} password reset completed",
            extra={"event": request.task_name, "username": request.username},
        )
        return JSONResponse({"status": "ok", "password": request.password})
    except HTTPException as exc:
        status = "error"
        error_detail = str(exc.detail)
        raise
    except Exception as exc:
        status = "error"
        error_detail = safe_error_detail(exc, request.error_hint)
        raise HTTPException(status_code=502, detail=error_detail)
    finally:
        _record_account_task(task_ctx, status, error_detail)


@app.on_event("startup")
def _startup() -> None:
    provisioning.start()

    scheduler.add_task("schedule.mailu_sync", settings.mailu_sync_cron, lambda: mailu.sync("ariadne_schedule"))
    scheduler.add_task(
        "schedule.nextcloud_sync",
        settings.nextcloud_sync_cron,
        lambda: nextcloud.sync_mail(wait=False),
    )
    scheduler.add_task(
        "schedule.nextcloud_cron",
        settings.nextcloud_cron,
        lambda: nextcloud.run_cron(),
    )
    scheduler.add_task(
        "schedule.nextcloud_maintenance",
        settings.nextcloud_maintenance_cron,
        lambda: nextcloud.run_maintenance(),
    )
    scheduler.add_task("schedule.vaultwarden_sync", settings.vaultwarden_sync_cron, run_vaultwarden_sync)
    scheduler.add_task(
        "schedule.keycloak_profile",
        settings.keycloak_profile_cron,
        run_profile_sync,
    )
    scheduler.add_task(
        "schedule.wger_user_sync",
        settings.wger_user_sync_cron,
        lambda: wger.sync_users(),
    )
    scheduler.add_task("schedule.wger_admin", settings.wger_admin_cron, lambda: wger.ensure_admin(wait=False))
    scheduler.add_task(
        "schedule.firefly_user_sync",
        settings.firefly_user_sync_cron,
        lambda: firefly.sync_users(),
    )
    scheduler.add_task(
        "schedule.firefly_cron",
        settings.firefly_cron,
        lambda: firefly.run_cron(),
    )
    scheduler.add_task(
        "schedule.pod_cleaner",
        settings.pod_cleaner_cron,
        clean_finished_pods,
    )
    scheduler.add_task(
        "schedule.opensearch_prune",
        settings.opensearch_prune_cron,
        prune_indices,
    )
    scheduler.add_task(
        "schedule.image_sweeper",
        settings.image_sweeper_cron,
        lambda: image_sweeper.run(wait=True),
    )
    scheduler.add_task(
        "schedule.vault_k8s_auth",
        settings.vault_k8s_auth_cron,
        lambda: vault.sync_k8s_auth(wait=True),
    )
    scheduler.add_task(
        "schedule.vault_oidc",
        settings.vault_oidc_cron,
        lambda: vault.sync_oidc(wait=True),
    )
    scheduler.add_task(
        "schedule.comms_guest_name",
        settings.comms_guest_name_cron,
        lambda: comms.run_guest_name_randomizer(wait=True),
    )
    scheduler.add_task(
        "schedule.comms_pin_invite",
        settings.comms_pin_invite_cron,
        lambda: comms.run_pin_invite(wait=True),
    )
    scheduler.add_task(
        "schedule.comms_reset_room",
        settings.comms_reset_room_cron,
        lambda: comms.run_reset_room(wait=True),
    )
    scheduler.add_task(
        "schedule.comms_seed_room",
        settings.comms_seed_room_cron,
        lambda: comms.run_seed_room(wait=True),
    )
    scheduler.start()
    logger.info(
        "ariadne started",
        extra={
            "event": "startup",
            "mailu_cron": settings.mailu_sync_cron,
            "nextcloud_mail_cron": settings.nextcloud_sync_cron,
            "nextcloud_cron": settings.nextcloud_cron,
            "nextcloud_maintenance_cron": settings.nextcloud_maintenance_cron,
            "vaultwarden_cron": settings.vaultwarden_sync_cron,
            "wger_user_sync_cron": settings.wger_user_sync_cron,
            "wger_admin_cron": settings.wger_admin_cron,
            "firefly_user_sync_cron": settings.firefly_user_sync_cron,
            "firefly_cron": settings.firefly_cron,
            "pod_cleaner_cron": settings.pod_cleaner_cron,
            "opensearch_prune_cron": settings.opensearch_prune_cron,
            "image_sweeper_cron": settings.image_sweeper_cron,
            "vault_k8s_auth_cron": settings.vault_k8s_auth_cron,
            "vault_oidc_cron": settings.vault_oidc_cron,
            "comms_guest_name_cron": settings.comms_guest_name_cron,
            "comms_pin_invite_cron": settings.comms_pin_invite_cron,
            "comms_reset_room_cron": settings.comms_reset_room_cron,
            "comms_seed_room_cron": settings.comms_seed_room_cron,
            "keycloak_profile_cron": settings.keycloak_profile_cron,
        },
    )


@app.on_event("shutdown")
def _shutdown() -> None:
    scheduler.stop()
    provisioning.stop()
    portal_db.close()
    ariadne_db.close()
    logger.info("ariadne stopped", extra={"event": "shutdown"})


@app.get("/health")
def health() -> dict[str, Any]:
    return {"ok": True}


@app.get(settings.metrics_path)
def metrics() -> Response:
    payload = generate_latest()
    return Response(payload, media_type=CONTENT_TYPE_LATEST)


@app.get("/api/admin/access/requests")
def list_access_requests(ctx: AuthContext = Depends(_require_auth)) -> JSONResponse:
    _require_admin(ctx)
    logger.info(
        "list access requests",
        extra={"event": "access_requests_list", "actor": ctx.username or ""},
    )
    try:
        rows = storage.list_pending_requests()
    except Exception:
        raise HTTPException(status_code=502, detail="failed to load requests")

    output: list[dict[str, Any]] = []
    for row in rows:
        created_at = row.get("created_at")
        output.append(
            {
                "id": row.get("request_code"),
                "username": row.get("username"),
                "email": row.get("contact_email") or "",
                "first_name": row.get("first_name") or "",
                "last_name": row.get("last_name") or "",
                "request_code": row.get("request_code"),
                "created_at": created_at.isoformat() if isinstance(created_at, datetime) else "",
                "note": row.get("note") or "",
            }
        )
    return JSONResponse({"requests": output})


@app.get("/api/admin/access/flags")
def list_access_flags(ctx: AuthContext = Depends(_require_auth)) -> JSONResponse:
    _require_admin(ctx)
    flags = settings.allowed_flag_groups
    if keycloak_admin.ready():
        try:
            flags = keycloak_admin.list_group_names(exclude={"admin"})
        except Exception:
            flags = settings.allowed_flag_groups
    return JSONResponse({"flags": flags})


@app.get("/api/admin/audit/events")
def list_audit_events(
    limit: int = 200,
    event_type: str | None = None,
    ctx: AuthContext = Depends(_require_auth),
) -> JSONResponse:
    _require_admin(ctx)
    try:
        rows = storage.list_events(limit=limit, event_type=event_type)
    except Exception:
        raise HTTPException(status_code=502, detail="failed to load audit events")

    output: list[dict[str, Any]] = []
    for row in rows:
        created_at = row.get("created_at")
        output.append(
            {
                "id": row.get("id"),
                "event_type": row.get("event_type"),
                "detail": _parse_event_detail(row.get("detail")),
                "created_at": created_at.isoformat() if isinstance(created_at, datetime) else "",
            }
        )
    return JSONResponse({"events": output})


@app.get("/api/admin/audit/task-runs")
def list_audit_task_runs(
    limit: int = 200,
    request_code: str | None = None,
    task: str | None = None,
    ctx: AuthContext = Depends(_require_auth),
) -> JSONResponse:
    _require_admin(ctx)
    try:
        rows = storage.list_task_runs(limit=limit, request_code=request_code, task=task)
    except Exception:
        raise HTTPException(status_code=502, detail="failed to load task runs")

    output: list[dict[str, Any]] = []
    for row in rows:
        started_at = row.get("started_at")
        finished_at = row.get("finished_at")
        output.append(
            {
                "id": row.get("id"),
                "request_code": row.get("request_code") or "",
                "task": row.get("task") or "",
                "status": row.get("status") or "",
                "detail": _parse_event_detail(row.get("detail")),
                "started_at": started_at.isoformat() if isinstance(started_at, datetime) else "",
                "finished_at": finished_at.isoformat() if isinstance(finished_at, datetime) else "",
                "duration_ms": row.get("duration_ms"),
            }
        )
    return JSONResponse({"task_runs": output})


@app.post("/api/admin/access/requests/{username}/approve")
async def approve_access_request(
    username: str,
    request: Request,
    ctx: AuthContext = Depends(_require_auth),
) -> JSONResponse:
    _require_admin(ctx)
    with task_context("admin.access.approve"):
        payload = await _read_json_payload(request)
        allowed_flags = _allowed_flag_groups()
        flags = [flag for flag in _flags_from_payload(payload) if flag in allowed_flags]
        note = _note_from_payload(payload)

        decided_by = ctx.username or ""
        try:
            row = portal_db.fetchone(
                """
                UPDATE access_requests
                SET status = 'approved',
                    decided_at = NOW(),
                    decided_by = %s,
                    approval_flags = %s,
                    approval_note = %s
                WHERE username = %s
                  AND status = 'pending'
                  AND email_verified_at IS NOT NULL
                RETURNING request_code
                """,
                (decided_by or None, flags or None, note, username),
            )
        except Exception:
            raise HTTPException(status_code=502, detail="failed to approve request")

        if not row:
            logger.info(
                "access request approval ignored",
                extra={"event": "access_request_approve", "actor": decided_by, "username": username, "status": "skipped"},
            )
            _record_event(
                "access_request_approve",
                {
                    "actor": decided_by,
                    "username": username,
                    "status": "skipped",
                },
            )
            return JSONResponse({"ok": True, "request_code": ""})

        request_code = row.get("request_code") or ""
        if request_code:
            threading.Thread(
                target=provisioning.provision_access_request,
                args=(request_code,),
                daemon=True,
            ).start()
        logger.info(
            "access request approved",
            extra={
                "event": "access_request_approve",
                "actor": decided_by,
                "username": username,
                "request_code": request_code,
            },
        )
        _record_event(
            "access_request_approve",
            {
                "actor": decided_by,
                "username": username,
                "request_code": request_code,
                "status": "ok",
                "flags": flags,
                "note": note or "",
            },
        )
        return JSONResponse({"ok": True, "request_code": request_code})


@app.post("/api/admin/access/requests/{username}/deny")
async def deny_access_request(
    username: str,
    request: Request,
    ctx: AuthContext = Depends(_require_auth),
) -> JSONResponse:
    _require_admin(ctx)
    with task_context("admin.access.deny"):
        payload = await _read_json_payload(request)
        note = _note_from_payload(payload)
        decided_by = ctx.username or ""

        try:
            row = portal_db.fetchone(
                """
                UPDATE access_requests
                SET status = 'denied',
                    decided_at = NOW(),
                    decided_by = %s,
                    denial_note = %s
                WHERE username = %s AND status = 'pending'
                RETURNING request_code
                """,
                (decided_by or None, note, username),
            )
        except Exception:
            raise HTTPException(status_code=502, detail="failed to deny request")

        if not row:
            logger.info(
                "access request denial ignored",
                extra={"event": "access_request_deny", "actor": decided_by, "username": username, "status": "skipped"},
            )
            _record_event(
                "access_request_deny",
                {
                    "actor": decided_by,
                    "username": username,
                    "status": "skipped",
                },
            )
            return JSONResponse({"ok": True, "request_code": ""})
        logger.info(
            "access request denied",
            extra={
                "event": "access_request_deny",
                "actor": decided_by,
                "username": username,
                "request_code": row.get("request_code") or "",
            },
        )
        _record_event(
            "access_request_deny",
            {
                "actor": decided_by,
                "username": username,
                "request_code": row.get("request_code") or "",
                "status": "ok",
                "note": note or "",
            },
        )
        return JSONResponse({"ok": True, "request_code": row.get("request_code")})


@app.post("/api/access/requests/{request_code}/retry")
def retry_access_request(request_code: str) -> JSONResponse:
    code = (request_code or "").strip()
    if not code:
        raise HTTPException(status_code=400, detail="request_code is required")
    if not keycloak_admin.ready():
        raise HTTPException(status_code=503, detail="server not configured")

    try:
        row = portal_db.fetchone(
            "SELECT status FROM access_requests WHERE request_code = %s",
            (code,),
        )
    except Exception:
        raise HTTPException(status_code=502, detail="failed to load request")

    if not row:
        raise HTTPException(status_code=404, detail="not found")

    status = (row.get("status") or "").strip()
    if status not in {"accounts_building", "approved"}:
        raise HTTPException(status_code=409, detail="request not retryable")

    try:
        portal_db.execute(
            "UPDATE access_requests SET provision_attempted_at = NULL WHERE request_code = %s",
            (code,),
        )
        portal_db.execute(
            """
            UPDATE access_request_tasks
            SET status = 'pending',
                detail = 'retry requested',
                updated_at = NOW()
            WHERE request_code = %s AND status = 'error'
            """,
            (code,),
        )
    except Exception:
        raise HTTPException(status_code=502, detail="failed to update retry state")

    threading.Thread(
        target=provisioning.provision_access_request,
        args=(code,),
        daemon=True,
    ).start()
    _record_event(
        "access_request_retry",
        {
            "request_code": code,
            "status": "ok",
        },
    )
    return JSONResponse({"ok": True, "request_code": code})


@app.post("/api/account/mailu/rotate")
def rotate_mailu_password(ctx: AuthContext = Depends(_require_auth)) -> JSONResponse:
    _require_account_access(ctx)
    if not keycloak_admin.ready():
        raise HTTPException(status_code=503, detail="server not configured")

    username = ctx.username or ""
    if not username:
        raise HTTPException(status_code=400, detail="missing username")
    with task_context("account.mailu_rotate"):
        started = datetime.now(timezone.utc)
        status = "ok"
        error_detail = ""
        sync_enabled = mailu.ready()
        sync_ok = False
        sync_error = ""
        nextcloud_sync: dict[str, Any] = {"status": "skipped"}

        logger.info(
            "mailu password rotate requested",
            extra={"event": "mailu_rotate", "username": username},
        )
        try:
            password = random_password()
            keycloak_admin.set_user_attribute(username, "mailu_app_password", password)

            if sync_enabled:
                try:
                    mailu.sync("ariadne_mailu_rotate")
                    sync_ok = True
                except Exception as exc:
                    sync_error = safe_error_detail(exc, "sync request failed")

            try:
                nextcloud_sync = nextcloud.sync_mail(username, wait=True)
            except Exception as exc:
                nextcloud_sync = {"status": "error", "detail": safe_error_detail(exc, "failed to sync nextcloud")}

            logger.info(
                "mailu password rotate completed",
                extra={
                    "event": "mailu_rotate",
                    "username": username,
                    "sync_enabled": sync_enabled,
                    "sync_ok": sync_ok,
                    "nextcloud_status": nextcloud_sync.get("status") if isinstance(nextcloud_sync, dict) else "",
                },
            )
            return JSONResponse(
                {
                    "password": password,
                    "sync_enabled": sync_enabled,
                    "sync_ok": sync_ok,
                    "sync_error": sync_error,
                    "nextcloud_sync": nextcloud_sync,
                }
            )
        except HTTPException as exc:
            status = "error"
            error_detail = str(exc.detail)
            raise
        except Exception as exc:
            status = "error"
            error_detail = safe_error_detail(exc, "mailu rotate failed")
            raise HTTPException(status_code=502, detail=error_detail)
        finally:
            finished = datetime.now(timezone.utc)
            duration_sec = (finished - started).total_seconds()
            record_task_run("mailu_rotate", status, duration_sec)
            try:
                storage.record_task_run(
                    TaskRunRecord(
                        request_code=None,
                        task="mailu_rotate",
                        status=status,
                        detail=error_detail or None,
                        started_at=started,
                        finished_at=finished,
                        duration_ms=int(duration_sec * 1000),
                    )
                )
            except Exception:
                pass
            _record_event(
                "mailu_rotate",
                {
                    "username": username,
                    "status": status,
                    "sync_enabled": sync_enabled,
                    "sync_ok": sync_ok,
                    "nextcloud_status": nextcloud_sync.get("status") if isinstance(nextcloud_sync, dict) else "",
                    "error": error_detail,
                },
            )


@app.post("/api/account/wger/reset")
def reset_wger_password(ctx: AuthContext = Depends(_require_auth)) -> JSONResponse:
    _require_account_access(ctx)
    if not keycloak_admin.ready():
        raise HTTPException(status_code=503, detail="server not configured")

    username = ctx.username or ""
    if not username:
        raise HTTPException(status_code=400, detail="missing username")

    with task_context("account.wger_reset"):
        mailu_email = _resolve_mailu_email(username)
        password = random_password()
        request = PasswordResetRequest(
            task_name="wger_reset",
            service_label="wger",
            username=username,
            mailu_email=mailu_email,
            password=password,
            sync_fn=lambda: wger.sync_user(username, mailu_email, password, wait=True),
            password_attr="wger_password",
            updated_attr="wger_password_updated_at",
            error_hint="wger sync failed",
        )
        return _run_password_reset(request)


@app.post("/api/account/firefly/reset")
def reset_firefly_password(ctx: AuthContext = Depends(_require_auth)) -> JSONResponse:
    _require_account_access(ctx)
    if not keycloak_admin.ready():
        raise HTTPException(status_code=503, detail="server not configured")

    username = ctx.username or ""
    if not username:
        raise HTTPException(status_code=400, detail="missing username")

    with task_context("account.firefly_reset"):
        mailu_email = _resolve_mailu_email(username)
        password = random_password(24)
        request = PasswordResetRequest(
            task_name="firefly_reset",
            service_label="firefly",
            username=username,
            mailu_email=mailu_email,
            password=password,
            sync_fn=lambda: firefly.sync_user(mailu_email, password, wait=True),
            password_attr="firefly_password",
            updated_attr="firefly_password_updated_at",
            error_hint="firefly sync failed",
        )
        return _run_password_reset(request)


@app.post("/api/account/firefly/rotation/check")
def firefly_rotation_check(ctx: AuthContext = Depends(_require_auth)) -> JSONResponse:
    _require_account_access(ctx)
    if not keycloak_admin.ready():
        raise HTTPException(status_code=503, detail="server not configured")

    username = ctx.username or ""
    if not username:
        raise HTTPException(status_code=400, detail="missing username")

    with task_context("account.firefly_rotation_check"):
        result = firefly.check_rotation_for_user(username)
        if result.get("status") == "error":
            raise HTTPException(status_code=502, detail=result.get("detail") or "firefly rotation check failed")
        return JSONResponse(result)


@app.post("/api/account/wger/rotation/check")
def wger_rotation_check(ctx: AuthContext = Depends(_require_auth)) -> JSONResponse:
    _require_account_access(ctx)
    if not keycloak_admin.ready():
        raise HTTPException(status_code=503, detail="server not configured")

    username = ctx.username or ""
    if not username:
        raise HTTPException(status_code=400, detail="missing username")

    with task_context("account.wger_rotation_check"):
        result = wger.check_rotation_for_user(username)
        if result.get("status") == "error":
            raise HTTPException(status_code=502, detail=result.get("detail") or "wger rotation check failed")
        return JSONResponse(result)


@app.post("/api/account/nextcloud/mail/sync")
async def nextcloud_mail_sync(request: Request, ctx: AuthContext = Depends(_require_auth)) -> JSONResponse:
    _require_account_access(ctx)
    if not keycloak_admin.ready():
        raise HTTPException(status_code=503, detail="server not configured")

    username = ctx.username or ""
    if not username:
        raise HTTPException(status_code=400, detail="missing username")

    with task_context("account.nextcloud_sync"):
        try:
            payload = await request.json()
        except Exception:
            payload = {}
        wait = bool(payload.get("wait", True)) if isinstance(payload, dict) else True

        started = datetime.now(timezone.utc)
        status = "ok"
        error_detail = ""
        logger.info(
            "nextcloud mail sync requested",
            extra={"event": "nextcloud_sync", "username": username, "wait": wait},
        )
        try:
            result = nextcloud.sync_mail(username, wait=wait)
            logger.info(
                "nextcloud mail sync completed",
                extra={
                    "event": "nextcloud_sync",
                    "username": username,
                    "status": result.get("status") if isinstance(result, dict) else "",
                },
            )
            return JSONResponse(result)
        except HTTPException as exc:
            status = "error"
            error_detail = str(exc.detail)
            raise
        except Exception as exc:
            status = "error"
            error_detail = safe_error_detail(exc, "failed to sync nextcloud mail")
            logger.info(
                "nextcloud mail sync failed",
                extra={"event": "nextcloud_sync", "username": username, "error": error_detail},
            )
            raise HTTPException(status_code=502, detail=error_detail)
        finally:
            finished = datetime.now(timezone.utc)
            duration_sec = (finished - started).total_seconds()
            record_task_run("nextcloud_sync", status, duration_sec)
            try:
                storage.record_task_run(
                    TaskRunRecord(
                        request_code=None,
                        task="nextcloud_sync",
                        status=status,
                        detail=error_detail or None,
                        started_at=started,
                        finished_at=finished,
                        duration_ms=int(duration_sec * 1000),
                    )
                )
            except Exception:
                pass
            _record_event(
                "nextcloud_sync",
                {
                    "username": username,
                    "status": status,
                    "wait": wait,
                    "error": error_detail,
                },
            )


@app.post("/events")
def mailu_event_listener(payload: dict[str, Any] | None = Body(default=None)) -> Response:
    status_code, response = mailu_events.handle_event(payload)
    return JSONResponse(response, status_code=status_code)