from django.core.management.base import BaseCommand
from task_management.models import Role


class Command(BaseCommand):
    help = 'Seed standard Roles for the client & task management system.'

    def handle(self, *args, **options):
        created = 0
        updated = 0
        catalog_defaults = Role.get_default_permissions()

        def ensure_role(name, description, enable_keys):
            nonlocal created, updated
            role, was_created = Role.objects.get_or_create(name=name, defaults={
                'description': description,
                'permissions': catalog_defaults.copy(),
                'is_active': True,
            })
            perms = role.permissions or {}
            changed = False
            for k in catalog_defaults.keys():
                target_val = True if k in enable_keys else False
                if perms.get(k) != target_val:
                    perms[k] = target_val
                    changed = True
            if was_created:
                created += 1
            if changed and not was_created:
                updated += 1
            if changed:
                role.permissions = perms
                role.is_active = True
                role.save()

        # Administrator — full access
        ensure_role(
            'Administrator',
            'Full access across all clients, projects, tasks, documents, and admin.',
            enable_keys=set(catalog_defaults.keys())
        )

        # Project Manager
        ensure_role(
            'Project Manager',
            'Manages projects, tasks, and client deliverables.',
            enable_keys={
                'view_dashboard',
                'view_clients', 'view_projects', 'view_tasks',
                'create_project', 'edit_project',
                'create_task', 'edit_task', 'delete_task', 'assign_task',
                'create_comment', 'delete_comment',
                'view_documents', 'request_documents', 'edit_document_requests',
                'delete_document_requests', 'publish_documents',
                'view_assets', 'request_assets', 'edit_asset_requests',
                'delete_asset_requests', 'approve_asset_requests', 'publish_assets',
                'view_company_documents',
                'view_approvals',
            }
        )

        # Employee — standard staff
        ensure_role(
            'Employee',
            'Standard staff: view projects and tasks assigned to them.',
            enable_keys={
                'view_dashboard',
                'view_clients', 'view_projects', 'view_tasks',
                'create_comment',
                'view_documents', 'view_assets',
                'view_company_documents',
            }
        )

        # Senior Employee — can create/edit tasks
        ensure_role(
            'Senior Employee',
            'Can create and edit tasks, add comments, view all work.',
            enable_keys={
                'view_dashboard',
                'view_clients', 'view_projects', 'view_tasks',
                'create_task', 'edit_task', 'assign_task',
                'create_comment',
                'view_documents', 'request_documents',
                'view_assets', 'request_assets',
                'view_company_documents',
                'upload_company_documents',
            }
        )

        self.stdout.write(self.style.SUCCESS(
            f'Roles seeding complete. Created: {created}, Updated: {updated}'
        ))