from django.contrib import messages
from django.shortcuts import render, redirect
from django.contrib.auth import authenticate, login, logout
from django.utils.http import url_has_allowed_host_and_scheme
from django.views.decorators.http import require_POST
from .forms import LoginForm
from .models import UserRole


def _admin_panel_user(user):
    if user.is_staff or user.is_superuser:
        return True
    try:
        return user.role.role == UserRole.Role.ADMIN
    except UserRole.DoesNotExist:
        return False


def login_page(request):
    if request.user.is_authenticated and _admin_panel_user(request.user):
        return redirect('core:dashboard')

    error_message = None
    form = LoginForm(request.POST or None)
    next_url = request.GET.get('next') or request.POST.get('next') or ''

    if request.method == "POST":
        if form.is_valid():
            email = form.cleaned_data['email'].strip().lower()
            password = form.cleaned_data['password']

            user = authenticate(request, username=email, password=password)
            if user:
                login(request, user)
                if next_url and url_has_allowed_host_and_scheme(
                    next_url,
                    allowed_hosts={request.get_host()},
                    require_https=request.is_secure(),
                ):
                    return redirect(next_url)
                if _admin_panel_user(user):
                    return redirect('core:dashboard')
                messages.error(request, 'You do not have access to the admin panel.')
                return redirect('login')
            error_message = "Invalid email or password"

    context = {
        'form': form,
        'error': error_message,
        'next': next_url,
    }
    return render(request, 'accounts/login.html', context)


@require_POST
def logout_page(request):
    logout(request)
    return redirect('login')