from functools import wraps
from django.shortcuts import redirect
from django.contrib import messages
from django.contrib.auth.decorators import login_required
from .models import StaffProfile, ActivityLog


def get_staff_profile(user):
    """Return StaffProfile or None."""
    try:
        return user.staff_profile
    except Exception:
        return None


def is_staff_active(user):
    """Check if user is an active staff member."""
    if not user.is_authenticated:
        return False
    if user.is_superuser:
        return True
    sp = get_staff_profile(user)
    return sp is not None and sp.is_active


def require_staff(view_func):
    """Require any active staff/admin."""
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect(f'/dashboard/login/?next={request.path}')
        if not is_staff_active(request.user):
            messages.error(request, 'Access denied. Staff account required.')
            return redirect('store:home')
        return view_func(request, *args, **kwargs)
    return wrapper


def require_superadmin(view_func):
    """Require superadmin role or Django superuser."""
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect(f'/dashboard/login/?next={request.path}')
        if request.user.is_superuser:
            return view_func(request, *args, **kwargs)
        sp = get_staff_profile(request.user)
        if sp and sp.is_active and sp.role == 'superadmin':
            return view_func(request, *args, **kwargs)
        messages.error(request, 'Super Admin access required.')
        return redirect('dashboard:home')
    return wrapper


def require_permission(perm):
    """Generic permission decorator. perm = field name on StaffProfile."""
    def decorator(view_func):
        @wraps(view_func)
        def wrapper(request, *args, **kwargs):
            if not request.user.is_authenticated:
                return redirect(f'/dashboard/login/?next={request.path}')
            if request.user.is_superuser:
                return view_func(request, *args, **kwargs)
            sp = get_staff_profile(request.user)
            if not sp or not sp.is_active:
                messages.error(request, 'Access denied.')
                return redirect('store:home')
            if sp.role == 'superadmin' or getattr(sp, perm, False):
                return view_func(request, *args, **kwargs)
            messages.error(request, f'You do not have permission for this action.')
            return redirect('dashboard:home')
        return wrapper
    return decorator


def log_activity(user, action, details='', request=None):
    """Log an admin activity."""
    ip = None
    if request:
        x_forwarded = request.META.get('HTTP_X_FORWARDED_FOR')
        ip = x_forwarded.split(',')[0] if x_forwarded else request.META.get('REMOTE_ADDR')
    ActivityLog.objects.create(user=user, action=action, details=details, ip=ip)


def get_user_permissions(user):
    """Return a dict of permission flags for the user."""
    if user.is_superuser:
        return {
            'can_manage_products': True,
            'can_manage_categories': True,
            'can_manage_orders': True,
            'can_manage_customers': True,
            'can_manage_coupons': True,
            'can_manage_reviews': True,
            'can_view_analytics': True,
            'can_manage_staff': True,
            'is_superadmin': True,
            'role': 'superadmin',
        }
    sp = get_staff_profile(user)
    if not sp or not sp.is_active:
        return {}
    return {
        'can_manage_products': sp.can_manage_products,
        'can_manage_categories': sp.can_manage_categories,
        'can_manage_orders': sp.can_manage_orders,
        'can_manage_customers': sp.can_manage_customers,
        'can_manage_coupons': sp.can_manage_coupons,
        'can_manage_reviews': sp.can_manage_reviews,
        'can_view_analytics': sp.can_view_analytics,
        'can_manage_staff': sp.can_manage_staff,
        'is_superadmin': sp.role == 'superadmin',
        'role': sp.role,
    }