from functools import wraps
from django.shortcuts import redirect
from django.contrib.auth.decorators import login_required
from .models import UserRole


def role_required(*roles):
    """Require the user to be logged in and have one of the given roles."""

    def decorator(view_func):
        @wraps(view_func)
        def _wrapped_view(request, *args, **kwargs):
            if not request.user.is_authenticated:
                return redirect('login')
            try:
                user_role = request.user.role.role
            except UserRole.DoesNotExist:
                return redirect('login')
            if user_role not in roles:
                return redirect('login')
            return view_func(request, *args, **kwargs)

        return _wrapped_view

    return decorator


def admin_required(view_func):
    """
    Require login for the web admin panel.
    Allowed: Django staff/superuser (same idea as API IsPlatformAdmin) or UserRole.ADMIN.
    """

    @wraps(view_func)
    def _wrapped(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect('login')
        if request.user.is_staff or request.user.is_superuser:
            return view_func(request, *args, **kwargs)
        try:
            if request.user.role.role == UserRole.Role.ADMIN:
                return view_func(request, *args, **kwargs)
        except UserRole.DoesNotExist:
            pass
        return redirect('login')

    return login_required(_wrapped)


def superuser_required(view_func):
    """Require Django superuser (web admin settings)."""

    @wraps(view_func)
    def _wrapped(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect('login')
        if not request.user.is_superuser:
            return redirect('core:dashboard')
        return view_func(request, *args, **kwargs)

    return login_required(_wrapped)