# app/main.py
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from app.routes import comments
from app.database import engine
from app.models import Base

app = FastAPI(title="Comment API", version="1.0.0")

# CORS for static sites
app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://yourdomain.com"],
    allow_methods=["GET", "POST", "PATCH", "DELETE"],
    allow_headers=["*"],
)

app.include_router(comments.router, prefix="/api")

@app.on_event("startup")
async def startup():
    async with engine.begin() as conn:
        await conn.run_sync(Base.metadata.create_all)

# app/models/comment.py
from sqlalchemy import Column, String, Text, DateTime, ForeignKey, Enum
from sqlalchemy.dialects.postgresql import UUID
from sqlalchemy.orm import relationship
from datetime import datetime
import uuid
import enum

class CommentStatus(enum.Enum):
    pending = "pending"
    approved = "approved"
    spam = "spam"
    deleted = "deleted"

class Comment(Base):
    __tablename__ = "comments"
    
    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    page_id = Column(String(255), nullable=False, index=True)
    parent_id = Column(UUID(as_uuid=True), ForeignKey("comments.id"))
    
    author_name = Column(String(100), nullable=False)
    author_email = Column(String(255))
    content = Column(Text, nullable=False)
    
    status = Column(Enum(CommentStatus), default=CommentStatus.pending)
    ip_address = Column(String(45))
    user_agent = Column(Text)
    
    created_at = Column(DateTime, default=datetime.utcnow)
    updated_at = Column(DateTime, onupdate=datetime.utcnow)
    
    replies = relationship("Comment", backref="parent", lazy="selectin")

# app/routes/comments.py
from fastapi import APIRouter, Depends, HTTPException, Request
from sqlalchemy.ext.asyncio import AsyncSession
from app.services.comment_service import CommentService
from app.schemas import CommentCreate, CommentResponse
from app.database import get_db

router = APIRouter(prefix="/comments", tags=["comments"])

@router.get("/")
async def list_comments(
    page_id: str,
    db: AsyncSession = Depends(get_db)
):
    service = CommentService(db)
    comments = await service.get_comments_for_page(page_id)
    return {"success": True, "data": comments}

@router.post("/", status_code=201)
async def create_comment(
    comment: CommentCreate,
    request: Request,
    db: AsyncSession = Depends(get_db)
):
    service = CommentService(db)
    result = await service.create_comment(
        comment,
        ip_address=request.client.host,
        user_agent=request.headers.get("user-agent")
    )
    return {"success": True, "data": result}

# app/services/comment_service.py
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select
from app.models.comment import Comment, CommentStatus
from app.services.spam_service import SpamService

class CommentService:
    def __init__(self, db: AsyncSession):
        self.db = db
        self.spam_service = SpamService()
    
    async def get_comments_for_page(self, page_id: str):
        query = (
            select(Comment)
            .where(Comment.page_id == page_id)
            .where(Comment.status == CommentStatus.approved)
            .where(Comment.parent_id.is_(None))
            .order_by(Comment.created_at.desc())
        )
        result = await self.db.execute(query)
        return result.scalars().all()
    
    async def create_comment(self, data, ip_address: str, user_agent: str):
        # Check for spam
        is_spam = await self.spam_service.check(
            data.content, data.author_email, ip_address
        )
        
        comment = Comment(
            page_id=data.page_id,
            parent_id=data.parent_id,
            author_name=data.author_name,
            author_email=data.author_email,
            content=data.content,
            ip_address=ip_address,
            user_agent=user_agent,
            status=CommentStatus.spam if is_spam else CommentStatus.pending
        )
        
        self.db.add(comment)
        await self.db.commit()
        await self.db.refresh(comment)
        return comment

# app/schemas.py
from pydantic import BaseModel, EmailStr, validator
from typing import Optional
from uuid import UUID
import bleach

class CommentCreate(BaseModel):
    page_id: str
    parent_id: Optional[UUID] = None
    author_name: str
    author_email: Optional[EmailStr] = None
    content: str
    
    @validator('author_name')
    def validate_name(cls, v):
        v = v.strip()
        if len(v) < 2 or len(v) > 100:
            raise ValueError('Name must be 2-100 characters')
        return v
    
    @validator('content')
    def validate_content(cls, v):
        v = v.strip()
        if len(v) < 1 or len(v) > 10000:
            raise ValueError('Content must be 1-10000 characters')
        # Sanitize HTML
        return bleach.clean(v, tags=['p', 'br', 'strong', 'em', 'a'], strip=True)

# app/utils/sanitizer.py
import bleach
import re

ALLOWED_TAGS = ['p', 'br', 'strong', 'em', 'a', 'code', 'pre', 'ul', 'ol', 'li']
ALLOWED_ATTRS = {'a': ['href', 'title']}

def sanitize_comment(content: str) -> str:
    # Remove dangerous content
    cleaned = bleach.clean(
        content,
        tags=ALLOWED_TAGS,
        attributes=ALLOWED_ATTRS,
        strip=True
    )
    
    # Convert URLs to links
    cleaned = bleach.linkify(cleaned)
    
    return cleaned

def extract_mentions(content: str) -> list:
    """Extract @username mentions"""
    pattern = r'@([a-zA-Z0-9_]+)'
    return re.findall(pattern, content)

# app/utils/rate_limiter.py
import redis
import time

class RateLimiter:
    def __init__(self, redis_client: redis.Redis):
        self.redis = redis_client
    
    def is_allowed(self, key: str, limit: int, window: int) -> bool:
        """
        Token bucket rate limiting
        key: identifier (IP, user_id)
        limit: max requests per window
        window: time window in seconds
        """
        current = time.time()
        pipe = self.redis.pipeline()
        
        # Remove old entries
        pipe.zremrangebyscore(key, 0, current - window)
        # Count recent entries
        pipe.zcard(key)
        # Add current request
        pipe.zadd(key, {str(current): current})
        # Set expiry
        pipe.expire(key, window)
        
        results = pipe.execute()
        request_count = results[1]
        
        return request_count < limit

# app/middleware/rate_limit.py
from fastapi import Request, HTTPException
from app.utils.rate_limiter import RateLimiter

async def rate_limit_middleware(request: Request, call_next):
    limiter = request.app.state.rate_limiter
    client_ip = request.client.host
    
    if not limiter.is_allowed(f"ip:{client_ip}", limit=30, window=60):
        raise HTTPException(
            status_code=429,
            detail="Too many requests. Please try again later."
        )
    
    return await call_next(request)

# app/exceptions.py
from fastapi import HTTPException
from fastapi.responses import JSONResponse

class CommentException(Exception):
    def __init__(self, code: str, message: str, status_code: int = 400):
        self.code = code
        self.message = message
        self.status_code = status_code

async def comment_exception_handler(request, exc: CommentException):
    return JSONResponse(
        status_code=exc.status_code,
        content={
            "success": False,
            "error": {
                "code": exc.code,
                "message": exc.message
            }
        }
    )

# Usage
raise CommentException("SPAM_DETECTED", "Your comment was flagged as spam")