from functools import wraps
from django.shortcuts import redirect
from django.http import HttpResponseForbidden, JsonResponse
from .models import StaffProfile
from system.access_policy import (
    MODULE_TASK,
    ACTION_VIEW,
    can_access_module,
    can_do_action,
)


def staff_required(view_func):
    """Ensure user is authenticated and has a staff profile."""
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect('task_management:login')
        # Superusers always pass
        if getattr(request.user, 'is_superuser', False):
            return view_func(request, *args, **kwargs)
        if not can_access_module(request.user, MODULE_TASK):
            return HttpResponseForbidden(
                '<h2>403 — Staff Access Required</h2>'
                '<p>You do not have access to the task management module.</p>'
            )
        try:
            sp = request.user.staff_profile
        except StaffProfile.DoesNotExist:
            sp = None
        if sp is not None and not sp.is_active:
            return redirect('task_management:login')
        if not can_do_action(request.user, MODULE_TASK, ACTION_VIEW):
            return HttpResponseForbidden('<h2>403 — Permission Denied</h2>')
        return view_func(request, *args, **kwargs)
    return wrapper


def permission_required(perm_key):
    """Check if staff user has the specified permission key."""
    def decorator(view_func):
        @wraps(view_func)
        def wrapper(request, *args, **kwargs):
            if not request.user.is_authenticated:
                return redirect('task_management:login')
            if getattr(request.user, 'is_superuser', False):
                return view_func(request, *args, **kwargs)
            try:
                profile = request.user.staff_profile
            except StaffProfile.DoesNotExist:
                profile = None
            if profile is None:
                return redirect('task_management:login')
            if not profile.has_perm(perm_key):
                if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
                    return JsonResponse({'error': 'Permission denied'}, status=403)
                return HttpResponseForbidden(
                    f'<h2>403 — Permission Denied</h2>'
                    f'<p>You need the <code>{perm_key}</code> permission.</p>'
                )
            return view_func(request, *args, **kwargs)
        return wrapper
    return decorator