service-finder/backend/app/api/v1/endpoints/users.py

#/opt/docker/dev/service_finder/backend/app/api/v1/endpoints/users.py
import copy

from fastapi import APIRouter, Depends, HTTPException, Query
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy.exc import SQLAlchemyError
from sqlalchemy import select, or_
from sqlalchemy.orm import joinedload
from sqlalchemy.orm.attributes import flag_modified
from typing import Dict, Any, List, Optional
from datetime import datetime

from app.api.deps import get_db, get_current_user
from app.schemas.user import UserResponse, UserUpdate, ActiveOrganizationUpdate, UserWithTokenResponse, PersonUpdate, ChangePasswordRequest
from app.schemas.address import AddressOut
from app.models.identity import User, Person
from app.models.identity.address import Address
from app.services.trust_engine import TrustEngine
from app.services.geo_service import GeoService
from app.services.auth_service import AuthService
from app.core.security import create_tokens, DEFAULT_RANK_MAP, verify_password, get_password_hash
from app.core.config import settings
from pydantic import BaseModel

router = APIRouter()
trust_engine = TrustEngine()

# MLM Hálózat válasz sémák
class NetworkMemberL1(BaseModel):
    email: str
    referral_code: str
    folder_slug: Optional[str]
    joined_at: datetime

class NetworkMemberL2L3(BaseModel):
    referral_code: str
    joined_at: datetime

class NetworkResponse(BaseModel):
    level1: List[NetworkMemberL1]
    level2: List[NetworkMemberL2L3]
    level3: List[NetworkMemberL2L3]


async def _resolve_subscription_data(
    db: AsyncSession,
    user: User,
    active_org_id: Optional[int] = None,
) -> dict:
    """
    P0 BUGFIX (2026-07-28): Unified subscription resolution shared by /auth/me and /users/me.

    Resolves the user's real subscription limits (max_vehicles, max_garages),
    display_name, expiry, auto-renewal fields, and active add-ons from the
    assigned subscription_tier JSONB rules.

    Resolution order:
    1. Org-level subscription (OrganizationSubscription) if active_org_id is set
    2. User-level subscription (UserSubscription) fallback
    3. Organization.base_asset_limit as ultimate fallback

    Returns a dict with all subscription-related fields ready to merge into
    the user response.
    """
    from app.models.core_logic import SubscriptionTier, OrganizationSubscription, UserSubscription
    from app.models.marketplace.organization import Organization

    tier: Optional[SubscriptionTier] = None
    subscription_record = None

    # Step 1: Try org-level subscription first
    if active_org_id is not None:
        org_sub_stmt = (
            select(OrganizationSubscription)
            .where(
                OrganizationSubscription.org_id == active_org_id,
                OrganizationSubscription.is_active == True,
            )
            .order_by(OrganizationSubscription.valid_from.desc())
            .limit(1)
        )
        subscription_record = (await db.execute(org_sub_stmt)).scalar_one_or_none()
        if subscription_record and subscription_record.tier_id:
            tier = await db.get(SubscriptionTier, subscription_record.tier_id)

    # Step 2: Fall back to user-level subscription (runs even when active_org_id is set)
    if subscription_record is None:
        user_sub_stmt = (
            select(UserSubscription)
            .where(
                UserSubscription.user_id == user.id,
                UserSubscription.is_active == True,
            )
            .order_by(UserSubscription.valid_from.desc())
            .limit(1)
        )
        subscription_record = (await db.execute(user_sub_stmt)).scalar_one_or_none()
        if subscription_record and subscription_record.tier_id:
            tier = await db.get(SubscriptionTier, subscription_record.tier_id)

    # Step 3: Extract limits from the resolved tier or fall back
    max_vehicles = 1
    max_garages = 1
    if tier and tier.rules:
        allowances = tier.rules.get("allowances", {})
        max_vehicles = int(allowances.get("max_vehicles", 1))
        max_garages = int(allowances.get("max_garages", 1))
    elif active_org_id is not None:
        org_stmt = select(Organization).where(Organization.id == active_org_id)
        org = (await db.execute(org_stmt)).scalar_one_or_none()
        if org:
            max_vehicles = org.base_asset_limit or 1
            max_garages = 1

    # Step 4: Extract metadata from the resolved subscription record
    subscription_display_name: Optional[str] = None
    subscription_valid_until: Optional[datetime] = None
    subscription_tier_id: Optional[int] = None
    subscription_valid_from: Optional[datetime] = None
    subscription_auto_renew: bool = False
    subscription_next_renewal_date: Optional[datetime] = None
    subscription_wallet_auto_deduct: bool = False

    if subscription_record is not None:
        subscription_valid_until = subscription_record.valid_until
        subscription_tier_id = subscription_record.tier_id
        subscription_valid_from = subscription_record.valid_from
        subscription_auto_renew = getattr(subscription_record, 'auto_renew', False)
        subscription_next_renewal_date = getattr(subscription_record, 'next_renewal_date', None)
        subscription_wallet_auto_deduct = getattr(subscription_record, 'wallet_auto_deduct', False)

    # Resolve display_name from the resolved tier
    if tier and tier.rules:
        subscription_display_name = tier.rules.get("display_name", None)

    # Step 5: Resolve active add-on subscriptions
    active_addons: List[Dict[str, Any]] = []
    if active_org_id is not None:
        addon_stmt = (
            select(OrganizationSubscription, SubscriptionTier)
            .join(SubscriptionTier, OrganizationSubscription.tier_id == SubscriptionTier.id)
            .where(
                OrganizationSubscription.org_id == active_org_id,
                OrganizationSubscription.is_active == True,
                SubscriptionTier.type == 'addon',
            )
            .order_by(OrganizationSubscription.valid_from.desc())
        )
        addon_result = await db.execute(addon_stmt)
        for sub, tier_row in addon_result:
            active_addons.append({
                "tier_id": tier_row.id,
                "display_name": tier_row.rules.get("display_name", tier_row.name) if tier_row.rules else tier_row.name,
                "valid_from": sub.valid_from.isoformat() if sub.valid_from else None,
                "valid_until": sub.valid_until.isoformat() if sub.valid_until else None,
                "is_active": sub.is_active,
            })
    else:
        addon_stmt = (
            select(UserSubscription, SubscriptionTier)
            .join(SubscriptionTier, UserSubscription.tier_id == SubscriptionTier.id)
            .where(
                UserSubscription.user_id == user.id,
                UserSubscription.is_active == True,
                SubscriptionTier.type == 'addon',
            )
            .order_by(UserSubscription.valid_from.desc())
        )
        addon_result = await db.execute(addon_stmt)
        for sub, tier_row in addon_result:
            active_addons.append({
                "tier_id": tier_row.id,
                "display_name": tier_row.rules.get("display_name", tier_row.name) if tier_row.rules else tier_row.name,
                "valid_from": sub.valid_from.isoformat() if sub.valid_from else None,
                "valid_until": sub.valid_until.isoformat() if sub.valid_until else None,
                "is_active": sub.is_active,
            })

    return {
        "max_vehicles": max_vehicles,
        "max_garages": max_garages,
        "subscription_display_name": subscription_display_name,
        "subscription_expires_at": subscription_valid_until.isoformat() if subscription_valid_until else None,
        "subscription_tier_id": subscription_tier_id,
        "subscription_valid_from": subscription_valid_from.isoformat() if subscription_valid_from else None,
        "subscription_auto_renew": subscription_auto_renew,
        "subscription_next_renewal_date": subscription_next_renewal_date.isoformat() if subscription_next_renewal_date else None,
        "subscription_wallet_auto_deduct": subscription_wallet_auto_deduct,
        "active_addons": active_addons,
        "subscription_plan": user.subscription_plan,
    }


async def _build_user_response(user: User, active_org_id: Optional[int] = None, db: Optional[AsyncSession] = None) -> dict:
    """
    Segédfüggvény a UserResponse dict előállításához.
    Beágyazza a Person és Address adatokat a 'person' mezőbe.
    RBAC Phase 3: system_capabilities és org_capabilities is bekerül a válaszba.
    P0: max_vehicles és max_garages a subscription_tier JSONB rules-ból.
    P0 Phase 6: system_capabilities now populated via DB-driven RBAC lookup.
    """
    from app.models.marketplace.organization import Organization, OrganizationMember
    from app.models.marketplace.organization import OrgUserRole
    from app.services.rbac_service import rbac_service

    # Determine active organization ID
    if active_org_id is None:
        if user.scope_id is not None:
            try:
                active_org_id = int(user.scope_id)
            except (ValueError, TypeError):
                active_org_id = None

    if active_org_id is None:
        pass

    person = user.person
    person_data = None
    if person:
        address_data = None
        if person.address:
            address_data = AddressOut.model_validate(person.address)
        person_data = {
            "id": person.id,
            "id_uuid": str(person.id_uuid) if person.id_uuid else None,
            "first_name": person.first_name,
            "last_name": person.last_name,
            "phone": person.phone,
            "mothers_last_name": person.mothers_last_name,
            "mothers_first_name": person.mothers_first_name,
            "birth_place": person.birth_place,
            "birth_date": person.birth_date,
            "identity_docs": person.identity_docs,
            "ice_contact": person.ice_contact,
            "is_active": person.is_active,
            "address": address_data,
        }

    # Get first_name/last_name from person for backward compatibility
    first_name = person.first_name if person else ""
    last_name = person.last_name if person else ""

    # ── RBAC Phase 3/6: Resolve system capabilities via DB-driven RBAC ──
    role_key = user.role.value if hasattr(user.role, 'value') else str(user.role)
    system_capabilities: Dict[str, bool] = {}

    if db is not None:
        # Use the role_id from the user's SystemRole mapping
        role_id = getattr(user, 'role_id', None)
        if role_id is not None:
            try:
                # Fetch all granted permission codes for this role from the DB
                perm_set = await rbac_service.get_role_permissions(db, role_id)
                # Convert the set of codes into a dict mapping code -> True
                system_capabilities = {code: True for code in perm_set}
            except Exception as e:
                logger.warning(f"Failed to resolve system_capabilities for user {user.id}: {e}")
                system_capabilities = {}

    # ── RBAC Phase 3: Resolve org capabilities ──
    org_capabilities: Dict[str, Dict[str, bool]] = {}
    if db is not None:
        pass

    # ── P0: Resolve subscription limits via shared function ──
    # P0 BUGFIX (2026-07-28): Previously hardcoded max_vehicles=1 / max_garages=1.
    # Now uses _resolve_subscription_data() which queries the actual subscription_tier
    # JSONB rules. This fixes both /auth/me and /users/me endpoints in one place.
    if db is not None:
        sub_data = await _resolve_subscription_data(db, user, active_org_id)
    else:
        sub_data = {
            "max_vehicles": 1,
            "max_garages": 1,
            "subscription_display_name": None,
            "subscription_expires_at": None,
            "subscription_tier_id": None,
            "subscription_valid_from": None,
            "subscription_auto_renew": False,
            "subscription_next_renewal_date": None,
            "subscription_wallet_auto_deduct": False,
            "active_addons": [],
            "subscription_plan": user.subscription_plan,
        }

    return {
        "id": user.id,
        "email": user.email,
        "first_name": first_name,
        "last_name": last_name,
        "is_active": user.is_active,
        "region_code": user.region_code,
        "person_id": user.person_id,
        "role": role_key,
        "subscription_plan": sub_data["subscription_plan"],
        "max_vehicles": sub_data["max_vehicles"],
        "max_garages": sub_data["max_garages"],
        "subscription_display_name": sub_data["subscription_display_name"],
        "subscription_expires_at": sub_data["subscription_expires_at"],
        "subscription_tier_id": sub_data["subscription_tier_id"],
        "subscription_valid_from": sub_data["subscription_valid_from"],
        "subscription_auto_renew": sub_data["subscription_auto_renew"],
        "subscription_next_renewal_date": sub_data["subscription_next_renewal_date"],
        "subscription_wallet_auto_deduct": sub_data["subscription_wallet_auto_deduct"],
        "active_addons": sub_data["active_addons"],
        "user_registration_date": user.created_at.isoformat() if user.created_at else None,
        "created_at": user.created_at.isoformat() if user.created_at else None,
        "scope_level": user.scope_level or "individual",
        "scope_id": str(active_org_id) if active_org_id else None,
        "ui_mode": user.ui_mode or "personal",
        "active_organization_id": active_org_id,
        "preferred_language": user.preferred_language or "hu",
        "person": person_data,
        "is_last_admin": False,  # Default, will be overridden in read_users_me
        # RBAC Phase 3/6: Rendszerszintű képességek (DB-driven)
        "system_capabilities": system_capabilities,
        # RBAC Phase 3: Szervezeti képességek (feltöltve a read_users_me végpontban)
        "org_capabilities": {},
    }


@router.get("/me", response_model=UserResponse)
async def read_users_me(
    db: AsyncSession = Depends(get_db),
    current_user: User = Depends(get_current_user),
):
    """Visszaadja a bejelentkezett felhasználó profilját beágyazott Person és Address adatokkal.
    RBAC Phase 3: system_capabilities és org_capabilities is bekerül a válaszba."""
    from app.models.marketplace.organization import Organization, OrganizationMember
    from app.models.marketplace.organization import OrgUserRole, OrgRole

    # Determine active organization ID
    active_org_id = None

    # If user already has a scope_id, use it
    if current_user.scope_id is not None:
        try:
            active_org_id = int(current_user.scope_id)
        except (ValueError, TypeError):
            active_org_id = None

    # If still no active org ID, try to find user's primary organization
    if active_org_id is None:
        # 1. Check if user is a member of any organization with ADMIN/OWNER role
        stmt = select(OrganizationMember.organization_id).where(
            OrganizationMember.user_id == current_user.id,
            or_(
                OrganizationMember.role == OrgUserRole.ADMIN,
                OrganizationMember.role == OrgUserRole.OWNER
            )
        ).limit(1)

        result = await db.execute(stmt)
        org_member_row = result.first()

        if org_member_row:
            active_org_id = org_member_row[0]
        else:
            # 2. Check if user owns any organization (owner_id matches user.id)
            stmt = select(Organization.id).where(
                Organization.owner_id == current_user.id
            ).limit(1)
            result = await db.execute(stmt)
            org_owner_row = result.first()

            if org_owner_row:
                active_org_id = org_owner_row[0]
            else:
                # 3. Fallback: get first organization they're a member of
                stmt = select(OrganizationMember.organization_id).where(
                    OrganizationMember.user_id == current_user.id
                ).limit(1)
                result = await db.execute(stmt)
                org_row = result.first()

                active_org_id = org_row[0] if org_row else None

    # Check if user is the last admin in any organization
    is_last_admin = await AuthService.check_is_last_admin(db, current_user.id)

    # ── P0: Resolve real subscription limits from the assigned tier ──
    # P0 BUGFIX (2026-07-28): Uses the shared _resolve_subscription_data() function
    # instead of duplicating the subscription resolution logic inline.
    # This fixes both /auth/me and /users/me in one place.
    #
    # _build_user_response() already calls _resolve_subscription_data() internally,
    # so _build_user_response now returns all subscription fields (max_vehicles,
    # subscription_display_name, etc.) in the base response. We just need to
    # override is_last_admin and org_capabilities post-build.
    sub_data = await _resolve_subscription_data(db, current_user, active_org_id)

    # ── RBAC Phase 3: Build base response ──
    # P0 Phase 6: Pass db so system_capabilities gets populated from DB
    response_data = await _build_user_response(current_user, active_org_id, db)
    response_data["is_last_admin"] = is_last_admin
    # All subscription fields are already in response_data from _build_user_response

    # ── RBAC Phase 3: Resolve org_capabilities ──
    # Get all organizations the user is a member of
    org_memberships_stmt = select(
        OrganizationMember.organization_id,
        OrganizationMember.role
    ).where(
        OrganizationMember.user_id == current_user.id,
        OrganizationMember.status == "active"
    )
    org_memberships_result = await db.execute(org_memberships_stmt)
    org_memberships = org_memberships_result.all()

    org_capabilities: Dict[str, Dict[str, bool]] = {}
    for membership in org_memberships:
        org_id = str(membership.organization_id)
        org_role_name = membership.role

        # Try to get permissions from OrgRole table first
        role_stmt = select(OrgRole.permissions).where(
            OrgRole.name_key == org_role_name,
            OrgRole.is_active == True
        ).limit(1)
        role_result = await db.execute(role_stmt)
        permissions = role_result.scalar_one_or_none()

        if not permissions:
            # Fallback: use OrganizationMember.permissions
            member_perm_stmt = select(OrganizationMember.permissions).where(
                OrganizationMember.user_id == current_user.id,
                OrganizationMember.organization_id == membership.organization_id,
                OrganizationMember.status == "active"
            ).limit(1)
            member_perm_result = await db.execute(member_perm_stmt)
            permissions = member_perm_result.scalar_one_or_none() or {}

        if not isinstance(permissions, dict):
            permissions = {}

        org_capabilities[org_id] = permissions

    response_data["org_capabilities"] = org_capabilities

    return UserResponse.model_validate(response_data)


@router.put("/me/person", response_model=UserResponse)
async def update_my_person(
    update_data: PersonUpdate,
    db: AsyncSession = Depends(get_db),
    current_user: User = Depends(get_current_user),
):
    """
    Frissíti a bejelentkezett felhasználó Person (és Address) rekordját.
    Elfogadja a PersonUpdate sémát, amely tartalmazza a személyes, okmány és cím adatokat.
    Visszaadja a frissített UserResponse objektumot.
    """
    # Reload user with eager loaded person + address
    stmt = (
        select(User)
        .where(User.id == current_user.id)
        .options(joinedload(User.person).joinedload(Person.address))
    )
    result = await db.execute(stmt)
    user = result.unique().scalar_one_or_none()
    if not user:
        raise HTTPException(status_code=404, detail="User not found")

    person = user.person
    if not person:
        raise HTTPException(status_code=400, detail="No Person record found. Complete KYC first.")

    # ── Update Person fields ──
    update_dict = update_data.model_dump(exclude_unset=True)

    person_fields = ["first_name", "last_name", "phone", "mothers_last_name",
                     "mothers_first_name", "birth_place", "birth_date"]

    for field in person_fields:
        if field in update_dict and update_dict[field] is not None:
            setattr(person, field, update_dict[field])

    # ── Update identity_docs (if provided and not None) ──
    if "identity_docs" in update_dict and update_dict["identity_docs"] is not None:
        # Use deep copy + flag_modified to ensure SQLAlchemy detects the JSON mutation
        existing_docs = copy.deepcopy(person.identity_docs) if person.identity_docs else {}
        if isinstance(existing_docs, dict) and isinstance(update_dict["identity_docs"], dict):
            existing_docs.update(update_dict["identity_docs"])
            person.identity_docs = existing_docs
            flag_modified(person, "identity_docs")
        else:
            person.identity_docs = update_dict["identity_docs"]
            flag_modified(person, "identity_docs")

    # ── Update Address fields (via AddressIn) ──
    addr_data = update_data.address
    if addr_data is not None:
        # Use GeoService to get or create address
        addr_id = await GeoService.get_or_create_full_address(
            db,
            zip_code=addr_data.zip,
            city=addr_data.city,
            street_name=addr_data.street_name,
            street_type=addr_data.street_type,
            house_number=addr_data.house_number,
            stairwell=addr_data.stairwell,
            floor=addr_data.floor,
            door=addr_data.door,
            parcel_id=addr_data.parcel_id,
        )
        if addr_id:
            person.address_id = addr_id
            # EXPLICIT betöltjük az új címet a memóriába, hogy felülírjuk a régit!
            person.address = await db.get(Address, addr_id)

    try:
        await db.commit()
        await db.refresh(person)
    except SQLAlchemyError as e:
        await db.rollback()
        raise HTTPException(status_code=500, detail=f"Database error: {str(e)}")

    # Build and return the full response
    response_data = await _build_user_response(user)
    return UserResponse.model_validate(response_data)


@router.put("/me/password", status_code=200)
async def change_my_password(
    change_data: ChangePasswordRequest,
    db: AsyncSession = Depends(get_db),
    current_user: User = Depends(get_current_user),
):
    """
    Jelszó módosítás a bejelentkezett felhasználó számára.

    Ellenőrzi a jelenlegi jelszót, validálja az új jelszó komplexitását,
    majd elmenti az új hash-t. Válaszként egy {'status': 'ok', 'message': ...} dict-et ad.
    """
    # 1. Ellenőrizzük a jelenlegi jelszót
    if not verify_password(change_data.current_password, current_user.hashed_password):
        raise HTTPException(
            status_code=400,
            detail="A jelenlegi jelszó helytelen."
        )

    # 2. Ellenőrizzük, hogy az új jelszó nem egyezik-e a régivel
    if verify_password(change_data.new_password, current_user.hashed_password):
        raise HTTPException(
            status_code=400,
            detail="Az új jelszó nem egyezhet meg a jelenlegi jelszóval."
        )

    # 3. Jelszó komplexitás ellenőrzése (dinamikus admin beállítások alapján)
    await AuthService._validate_password_complexity(db, change_data.new_password, current_user.region_code)

    # 4. Új jelszó hash-elése és mentése
    current_user.hashed_password = get_password_hash(change_data.new_password)

    try:
        await db.commit()
        await db.refresh(current_user)
    except SQLAlchemyError as e:
        await db.rollback()
        raise HTTPException(status_code=500, detail=f"Database error: {str(e)}")

    return {"status": "ok", "message": "Jelszó sikeresen megváltoztatva."}


@router.get("/me/trust")
async def get_user_trust(
    db: AsyncSession = Depends(get_db),
    current_user: User = Depends(get_current_user),
    force_recalculate: bool = False,
) -> Dict[str, Any]:
    """
    Visszaadja a felhasználó Gondos Gazda Index (Trust Score) értékét.

    A számítás dinamikusan betölti a paramétereket a SystemParameter rendszerből
    (Global/Country/Region/User hierarchia).

    Paraméterek:
    - force_recalculate: Ha True, akkor újraszámolja a trust score-t
      (alapértelmezetten cache-elt értéket ad vissza, ha kevesebb mint 24 órája számoltuk)
    """
    trust_data = await trust_engine.calculate_user_trust(
        db=db,
        user_id=current_user.id,
        force_recalculate=force_recalculate
    )
    return trust_data


@router.patch("/me/preferences", response_model=UserResponse)
async def update_user_preferences(
    update_data: UserUpdate,
    db: AsyncSession = Depends(get_db),
    current_user: User = Depends(get_current_user),
):
    """
    Update user preferences (ui_mode, preferred_language, etc.)
    """
    # Filter out None values
    update_dict = update_data.dict(exclude_unset=True)
    if not update_dict:
        raise HTTPException(status_code=400, detail="No fields to update")

    # Validate ui_mode if present
    if "ui_mode" in update_dict:
        if update_dict["ui_mode"] not in ["personal", "fleet"]:
            raise HTTPException(status_code=422, detail="ui_mode must be 'personal' or 'fleet'")

    # Update user fields
    for field, value in update_dict.items():
        if hasattr(current_user, field):
            setattr(current_user, field, value)
        else:
            raise HTTPException(status_code=400, detail=f"Invalid field: {field}")

    try:
        await db.commit()
        await db.refresh(current_user)
    except SQLAlchemyError as e:
        await db.rollback()
        raise HTTPException(status_code=500, detail=f"Database error: {str(e)}")

    # Return the Pydantic model instead of raw SQLAlchemy object
    response_data = await _build_user_response(current_user)
    return UserResponse.model_validate(response_data)


@router.patch("/me/active-organization", response_model=UserWithTokenResponse)
async def update_active_organization(
    update_data: ActiveOrganizationUpdate,
    db: AsyncSession = Depends(get_db),
    current_user: User = Depends(get_current_user),
):
    """
    Update the user's active organization (scope_id).

    Accepts an organization_id (UUID/string) or None to revert to personal mode.
    Returns a new JWT token with updated scope_id in the payload.
    """
    # Extract organization_id from request
    org_id = update_data.organization_id

    # Validate that the user has access to this organization if org_id is provided
    if org_id is not None:
        from sqlalchemy import select
        from app.models.marketplace.organization import OrganizationMember

        # Check if user is a member of the organization
        stmt = select(OrganizationMember).where(
            OrganizationMember.organization_id == org_id,
            OrganizationMember.user_id == current_user.id
        )
        result = await db.execute(stmt)
        member = result.scalar_one_or_none()

        if not member:
            raise HTTPException(
                status_code=403,
                detail="You are not a member of this organization"
            )

    # Update user's scope_id (stored as string in DB, convert from int)
    current_user.scope_id = str(org_id) if org_id is not None else None

    try:
        await db.commit()
        await db.refresh(current_user)
    except SQLAlchemyError as e:
        await db.rollback()
        raise HTTPException(status_code=500, detail=f"Database error: {str(e)}")

    # Generate new JWT token with updated scope_id
    role_key = current_user.role.value.upper()
    token_payload = {
        "sub": str(current_user.id),
        "role": role_key,
        "rank": DEFAULT_RANK_MAP.get(role_key, "user"),
        "scope_level": "organization" if org_id else "personal",
        "scope_id": str(org_id) if org_id is not None else None,
        "person_id": str(current_user.person_id) if current_user.person_id else None,
    }

    access_token, _ = create_tokens(data=token_payload)

    # Return user data with new token
    response_data = await _build_user_response(current_user)
    return UserWithTokenResponse(
        user=UserResponse.model_validate(response_data),
        access_token=access_token,
        token_type="bearer"
    )


@router.get("/me/network", response_model=NetworkResponse)
async def get_my_network(
    db: AsyncSession = Depends(get_db),
    current_user: User = Depends(get_current_user),
):
    """
    Visszaadja a felhasználó MLM hálózatát 3 szinten:
    - L1: Közvetlen meghívottak (email + kód)
    - L2: L1 meghívottai (csak kód)
    - L3: L2 meghívottai (csak kód)
    """
    # L1: Közvetlen meghívottak
    l1_stmt = select(User).where(User.referred_by_id == current_user.id)
    l1_result = await db.execute(l1_stmt)
    l1_users = l1_result.scalars().all()

    level1 = [
        NetworkMemberL1(
            email=u.email,
            referral_code=u.referral_code or "",
            folder_slug=u.folder_slug,
            joined_at=u.created_at
        )
        for u in l1_users
    ]

    # L2: L1 userek által meghívottak
    level2 = []
    if l1_users:
        l1_ids = [u.id for u in l1_users]
        l2_stmt = select(User).where(User.referred_by_id.in_(l1_ids))
        l2_result = await db.execute(l2_stmt)
        l2_users = l2_result.scalars().all()

        level2 = [
            NetworkMemberL2L3(
                referral_code=u.referral_code or "",
                joined_at=u.created_at
            )
            for u in l2_users
        ]

    # L3: L2 userek által meghívottak
    level3 = []
    if l2_users:
        l2_ids = [u.id for u in l2_users]
        l3_stmt = select(User).where(User.referred_by_id.in_(l2_ids))
        l3_result = await db.execute(l3_stmt)
        l3_users = l3_result.scalars().all()

        level3 = [
            NetworkMemberL2L3(
                referral_code=u.referral_code or "",
                joined_at=u.created_at
            )
            for u in l3_users
        ]

    return NetworkResponse(
        level1=level1,
        level2=level2,
        level3=level3
    )


@router.delete("/me", status_code=200)
async def delete_my_account(
    reason: Optional[str] = Query(None, description="Törlés oka (opcionális)"),
    db: AsyncSession = Depends(get_db),
    current_user: User = Depends(get_current_user),
):
    """
    Saját fiók soft-delete.
    
    Üzleti logika:
    - Anonimizálja az e-mail címet (deleted_{id}_{timestamp}_{original_email})
    - is_active = False, is_deleted = True, deleted_at = timestamp
    - Person rekordot NEM bántja (megőrizzük a jövőbeli újraaktiváláshoz)
    - Wallet és Gamification adatokat megőrzi (inaktív user miatt freeze)
    - JWT token-ek a deleted_at middleware ellenőrzés miatt automatikusan érvénytelenülnek
    """
    success = await AuthService.soft_delete_user(
        db=db,
        user_id=current_user.id,
        reason=reason or "user_requested_self_delete",
        actor_id=current_user.id
    )
    
    if not success:
        raise HTTPException(
            status_code=400,
            detail="A felhasználó már törölve van."
        )
    
    return {"status": "ok", "message": "Fiók sikeresen törölve."}