"""AAT Demo Web Application — Flask single-file server.

WARNING: Demo only. Do NOT use in production.
Hardcoded secret key, in-memory store, no input sanitization.
"""

from flask import Flask, flash, redirect, render_template, request, session, url_for

app = Flask(__name__)
app.secret_key = "aat-demo-secret-key-2026"  # noqa: S105  # Demo only

# In-memory user store
users: dict[str, dict[str, str]] = {}


@app.route("/")
def index():
    return render_template("index.html")


@app.route("/register", methods=["GET", "POST"])
def register():
    if request.method == "POST":
        name = request.form.get("name", "").strip()
        email = request.form.get("email", "").strip()
        password = request.form.get("password", "").strip()

        if not name or not email or not password:
            flash("All fields are required.", "error")
            return render_template("register.html")

        if email in users:
            flash("Email already registered.", "error")
            return render_template("register.html")

        users[email] = {"name": name, "password": password}
        flash("Registration successful! Please login.", "success")
        return redirect(url_for("login"))

    return render_template("register.html")


@app.route("/login", methods=["GET", "POST"])
def login():
    if request.method == "POST":
        email = request.form.get("email", "").strip()
        password = request.form.get("password", "").strip()

        user = users.get(email)
        if user and user["password"] == password:
            session["user_email"] = email
            session["user_name"] = user["name"]
            flash(f"Welcome back, {user['name']}!", "success")
            return redirect(url_for("main"))

        flash("Invalid email or password.", "error")
        return render_template("login.html")

    return render_template("login.html")


@app.route("/main")
def main():
    if "user_email" not in session:
        flash("Please login first.", "error")
        return redirect(url_for("login"))
    return render_template("main.html", name=session["user_name"])


@app.route("/logout")
def logout():
    session.clear()
    flash("You have been logged out.", "success")
    return redirect(url_for("index"))


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5001, debug=True)
