elemes/routes/lessons.py

"""
Lesson JSON API routes consumed by the SvelteKit frontend.
"""

import os

from flask import Blueprint, Response, abort, request, jsonify, send_from_directory
from werkzeug.utils import safe_join, secure_filename

from compiler import compiler_factory
from config import ASSET_CACHE_MAX_AGE, ASSETS_DIR
from services import image_cache
from services.lesson_service import (
    get_missing_prerequisites,
    get_ordered_lessons_with_learning_objectives,
    get_sub_home_data,
    get_sub_home_path,
    find_sub_home_for_lesson,
    render_markdown_content,
    render_home_content,
    find_lesson_file,
)
from services.token_service import get_student_progress, has_quiz_attempt, is_quiz_attempt_resumable

lessons_bp = Blueprint('lessons', __name__)


def _parse_variant_width(raw: str | None) -> int | None:
    """Parse parameter `?w=` (lebar alternatif, px).

    Nilai tidak valid / di luar rentang aman → None (pakai lebar default).
    """
    if not raw:
        return None
    try:
        width = int(raw)
    except (TypeError, ValueError):
        return None
    if width < 1 or width > 4096:
        return None
    return width


def _prereq_specs(lesson):
    """Spec prasyarat untuk pengecekan kunci.

    Prioritas `prerequisite_specs` (slug + min_percent); fallback ke
    `prerequisites` (slug saja) bila spec belum ada (data legacy).
    """
    return lesson.get('prerequisite_specs') or lesson.get('prerequisites', [])


@lessons_bp.route('/lessons')
def api_lessons():
    """Return lesson list + home content as JSON."""
    token = request.args.get('token', '') or request.cookies.get('student_token', '')

    progress = None
    if token:
        progress = get_student_progress(token)

    lessons = get_ordered_lessons_with_learning_objectives(progress)

    # Calculate locked status — prasyarat terpenuhi bila completed ATAU sudah
    # discor (skor berapa pun, atau di atas ambang `min: N%` bila dideklarasikan).
    for lesson in lessons:
        lesson['locked'] = bool(get_missing_prerequisites(progress, _prereq_specs(lesson)))

    home_content = render_home_content()

    return jsonify({
        'lessons': lessons,
        'home_content': home_content,
    })


@lessons_bp.route('/bab/<folder>')
def api_bab(folder):
    """Return sub-home data for a given folder (e.g. 'dasar', 'arduino')."""
    data = get_sub_home_data(folder)
    if not data:
        return jsonify({'error': 'Bab not found'}), 404

    # Suntik progress & lock status per lesson (sama seperti /lessons) agar
    # centang hijau & ikon kunci muncul di halaman bab.
    token = request.args.get('token', '') or request.cookies.get('student_token', '')
    progress = None
    if token:
        progress = get_student_progress(token)

    source_path = get_sub_home_path(folder)
    ordered = get_ordered_lessons_with_learning_objectives(
        progress,
        source_path=source_path if source_path else None,
    )
    for lesson in ordered:
        lesson['locked'] = bool(get_missing_prerequisites(progress, _prereq_specs(lesson)))
    data['lessons'] = ordered

    return jsonify(data)


@lessons_bp.route('/lesson/<filename>.json')
def api_lesson(filename):
    """Return single lesson data as JSON."""
    full_filename = filename if filename.endswith('.md') else f'{filename}.md'
    file_path = find_lesson_file(full_filename)
    if not file_path:
        return jsonify({'error': 'Lesson not found'}), 404

    parsed_data = render_markdown_content(file_path)
    lesson_html = parsed_data['lesson_html']
    exercise_html = parsed_data['exercise_html']
    expected_output = parsed_data['expected_output']
    expected_output_python = parsed_data.get('expected_output_python', '')
    expected_circuit_output = parsed_data.get('expected_circuit_output', '')
    key_text_circuit = parsed_data.get('key_text_circuit', '')
    lesson_info = parsed_data['lesson_info']
    initial_code = parsed_data['initial_code']
    solution_code = parsed_data['solution_code']
    solution_circuit = parsed_data.get('solution_circuit', '')
    solution_python = parsed_data.get('solution_python', '')
    key_text = parsed_data['key_text']
    active_tabs = parsed_data['active_tabs']
    quiz_data = parsed_data.get('quiz_data', [])

    # New specific fields for hybrid lessons
    initial_circuit = parsed_data.get('initial_circuit', '')
    initial_code_c = parsed_data.get('initial_code_c', '')
    initial_python = parsed_data.get('initial_python', '')
    initial_flowchart = parsed_data.get('initial_flowchart', None)
    initial_quiz = parsed_data.get('initial_quiz', '')

    # Arduino/Velxio fields
    initial_code_arduino = parsed_data.get('initial_code_arduino', '')
    velxio_circuit = parsed_data.get('velxio_circuit', '')
    expected_serial_output = parsed_data.get('expected_serial_output', '')
    expected_wiring = parsed_data.get('expected_wiring', '')
    expected_flowchart = parsed_data.get('expected_flowchart', '')
    
    evaluation_config_raw = parsed_data.get('evaluation_config', '')
    evaluation_config = {}
    if evaluation_config_raw:
        import json
        try:
            evaluation_config = json.loads(evaluation_config_raw)
        except Exception:
            pass

    if not initial_code:
        initial_code = (
            '#include <stdio.h>\n\nint main() {\n'
            '    // Write your code here\n'
            '    printf("Hello, World!\\n");\n'
            '    return 0;\n}'
        )

    token = request.args.get('token', '') or request.cookies.get('student_token', '')
    progress = None
    lesson_completed = False
    lesson_progress_status = ''
    lesson_slug = full_filename.replace('.md', '')
    user_has_quiz_attempt = False
    quiz_resumable = False
    if token:
        progress = get_student_progress(token)
        if progress:
            status = progress.get(lesson_slug, '')
            lesson_progress_status = status
            lesson_completed = status not in (None, '', 'not_started')
        user_has_quiz_attempt = has_quiz_attempt(token, lesson_slug)
        quiz_resumable = is_quiz_attempt_resumable(token, lesson_slug)

    # Detect sub-home for this lesson's folder (untuk sidebar & navigasi)
    sub_home_path, sub_home_folder = find_sub_home_for_lesson(file_path)
    sub_home = None
    if sub_home_path and sub_home_folder:
        sub_home_data = get_sub_home_data(sub_home_folder)
        sub_home = {
            'folder': sub_home_folder,
            'url': f'/bab/{sub_home_folder}',
            'title': sub_home_data['title'] if sub_home_data else sub_home_folder.replace('_', ' ').title(),
        }

    # ordered_lessons: daftar materi scoped ke sub-home.md bila folder memilikinya,
    # fallback ke daftar global home.md bila tidak.
    all_lessons = get_ordered_lessons_with_learning_objectives(
        progress,
        source_path=sub_home_path if (sub_home_path and sub_home_folder) else None,
    )

    current_idx = -1
    current_lesson_meta = None
    for i, les in enumerate(all_lessons):
        if les['filename'] == full_filename:
            current_idx = i
            current_lesson_meta = les
            break

    # Bila lesson tidak ada di daftar sub-home (mis. belum dicantumkan di
    # sub-home.md), fallback ke daftar global home.md agar sidebar tidak kosong.
    if current_idx < 0:
        all_lessons = get_ordered_lessons_with_learning_objectives(progress)
        for i, les in enumerate(all_lessons):
            if les['filename'] == full_filename:
                current_idx = i
                current_lesson_meta = les
                break

    # Prerequisite check — status scored (mis. "3/4") juga memenuhi prasyarat,
    # kecuali ada ambang `min: N%` yang belum tercapai.
    missing_prereqs = []
    if current_lesson_meta:
        missing_prereqs = get_missing_prerequisites(progress, _prereq_specs(current_lesson_meta))
    is_locked = bool(missing_prereqs)

    prev_lesson = all_lessons[current_idx - 1] if current_idx > 0 else None
    next_lesson = all_lessons[current_idx + 1] if 0 <= current_idx < len(all_lessons) - 1 else None

    # Derive default language from active_tabs (frontend manages switching)
    if 'python' in active_tabs and 'c' not in active_tabs:
        programming_language = 'python'
    else:
        programming_language = 'c'
    language_display_name = compiler_factory.get_language_display_name(programming_language)

    if is_locked:
        # Strip sensitive data to prevent inspection bypass
        exercise_html = ""
        expected_output = ""
        expected_output_python = ""
        expected_circuit_output = ""
        initial_code = "// Konten terkunci. Selesaikan prasyarat untuk melihat."
        initial_circuit = ""
        initial_code_c = ""
        initial_python = ""
        initial_flowchart = None
        initial_quiz = ""
        initial_code_arduino = ""
        velxio_circuit = ""
        expected_serial_output = ""
        expected_wiring = ""
        expected_flowchart = ""
        solution_code = ""
        solution_circuit = ""
        solution_python = ""
        key_text = ""
        key_text_circuit = ""
        quiz_data = []
        parsed_data['slides'] = []
        # Keep lesson_html, lesson_info, etc. for reading


    # Anti-cache: tiap request lesson selalu fresh dari disk (bukan cache
    # browser/SW/proxy). Ini mencegah soal kuis "stale" saat file lesson diubah
    # — terutama setelah navigasi antar tipe soal (mcq ↔ flashcard).
    resp = jsonify({
        'lesson_content': lesson_html,
        'exercise_content': exercise_html,
        'expected_output': expected_output,
        'expected_output_python': expected_output_python,
        'expected_circuit_output': expected_circuit_output,
        'lesson_info': lesson_info,
        'initial_code': initial_code,
        'initial_circuit': initial_circuit,
        'initial_code_c': initial_code_c,
        'initial_python': initial_python,
        'initial_flowchart': initial_flowchart,
        'initial_quiz': initial_quiz,
        'initial_code_arduino': initial_code_arduino,
        'velxio_circuit': velxio_circuit,
        'expected_serial_output': expected_serial_output,
        'expected_wiring': expected_wiring,
        'expected_flowchart': expected_flowchart,
        'evaluation_config': evaluation_config,
        'solution_code': solution_code,
        'solution_circuit': solution_circuit,
        'solution_python': solution_python,
        'key_text': key_text,
        'key_text_circuit': key_text_circuit,
        'active_tabs': active_tabs,
        'quiz_data': quiz_data,
        'slides': parsed_data.get('slides', []),
        'lesson_progress_status': lesson_progress_status,
        'lesson_title': current_lesson_meta['title'] if current_lesson_meta else full_filename.replace('.md', '').replace('_', ' ').title(),
        'lesson_completed': lesson_completed,
        'has_quiz_attempt': user_has_quiz_attempt,
        'quiz_resumable': quiz_resumable,
        'locked': is_locked,
        'missing_prerequisites': missing_prereqs,
        'prev_lesson': prev_lesson,
        'next_lesson': next_lesson,
        'ordered_lessons': all_lessons,
        'sub_home': sub_home,
        'language': programming_language,
        'language_display_name': language_display_name,
    })
    resp.headers['Cache-Control'] = 'no-store, no-cache, must-revalidate, max-age=0'
    resp.headers['Pragma'] = 'no-cache'
    return resp


@lessons_bp.route('/get-key-text/<filename>')
def get_key_text(filename):
    """Get the key text for a specific lesson."""
    file_path = find_lesson_file(filename)
    if not file_path:
        return jsonify({'success': False, 'error': 'Lesson not found'}), 404

    parsed_data = render_markdown_content(file_path)
    return jsonify({'success': True, 'key_text': parsed_data['key_text']})


@lessons_bp.route('/assets/<path:path>')
def send_assets(path):
    """Serve asset files (images, etc.) from ASSETS_DIR.

    Gambar raster (png/jpg/jpeg/webp/gif) di-serve sebagai versi ringan:
    resize (maks dimensi) + WebP, di-generate on-the-fly lalu di-cache di
    `CACHE_DIR` (di luar ASSETS_DIR — lihat config.py). Original tetap utuh
    di storage dan bisa diakses lewat `?orig=1`.

    SVG & GIF animasi di-serve apa adanya. File korrupt / Pillow gagal →
    fallback ke original.
    """
    abs_path = safe_join(ASSETS_DIR, path)
    if abs_path is None or not os.path.isfile(abs_path):
        abort(404)

    want_original = request.args.get('orig') in ('1', 'true', 'yes')
    width = _parse_variant_width(request.args.get('w'))

    if not want_original:
        variant = image_cache.get_variant(abs_path, path, width)
        if variant is not None:
            data, etag = variant
            if request.if_none_match and etag in request.if_none_match:
                resp = Response(status=304)
            else:
                resp = Response(data, mimetype='image/webp')
                resp.headers['Content-Length'] = str(len(data))
            resp.headers['ETag'] = f'"{etag}"'
            resp.headers['Cache-Control'] = f'public, max-age={ASSET_CACHE_MAX_AGE}'
            resp.headers['X-Asset-Variant'] = 'webp'
            return resp

    # Pass-through: original apa adanya (SVG, GIF animasi, ?orig=1, raster
    # yang gagal di-variant-kan).
    response = send_from_directory(ASSETS_DIR, path)
    # Mitigasi stored-XSS: SVG bisa memuat <script>. Route ini publik
    # (same-origin) — kalau SVG dibuka langsung di tab browser, script-nya
    # bisa membaca localStorage (token siswa/guru). CSP ketat mematikan
    # semua eksekusi di dokumen tersebut; sandbox melarang navigasi/form.
    if path.lower().endswith(".svg"):
        response.headers["Content-Security-Policy"] = "default-src 'none'; sandbox"
    response.headers['Cache-Control'] = f'public, max-age={ASSET_CACHE_MAX_AGE}'
    response.headers['X-Asset-Variant'] = 'original'
    return response