from functools import wraps
from datetime import timedelta

from django.contrib import messages
from django.contrib.auth.decorators import login_required
from django.shortcuts import redirect
from django.utils import timezone

ADMIN_UNLOCK_SESSION = "company_admin_unlock"
ADMIN_UNLOCK_MINUTES = 30


def _unlock_is_valid(request):
    user = request.user
    if getattr(user, "is_superadmin", False) or getattr(user, "role", None) == "admin":
        return True
    company_id = request.session.get(ADMIN_UNLOCK_SESSION)
    unlocked_at = request.session.get(f"{ADMIN_UNLOCK_SESSION}_at")
    if not company_id or not unlocked_at or str(company_id) != str(getattr(user, "company_id", "")):
        return False
    try:
        unlocked_at = timezone.datetime.fromisoformat(unlocked_at)
        if timezone.is_naive(unlocked_at):
            unlocked_at = timezone.make_aware(unlocked_at, timezone.get_current_timezone())
    except (TypeError, ValueError):
        return False
    return timezone.now() - unlocked_at < timedelta(minutes=ADMIN_UNLOCK_MINUTES)


def superadmin_required(view_func):
    """Only the platform super admin can access this view."""
    @login_required
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if not getattr(request.user, "is_superadmin", False):
            messages.error(request, "Only the super admin can access this page.")
            return redirect("dashboard")
        return view_func(request, *args, **kwargs)
    return wrapper


def company_admin_required(view_func):
    """Only a registered company's admin can access this view."""
    @login_required
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        user = request.user
        if getattr(user, "is_superadmin", False):
            return redirect("superadmin_dashboard")
        if getattr(user, "role", None) != "admin" or getattr(user, "company_id", None) is None:
            messages.error(request, "Only the company administrator can access this page.")
            return redirect("sales_dashboard")
        return view_func(request, *args, **kwargs)
    return wrapper


def admin_area_required(view_func):
    """Company-admin pages with a controlled unlock for sales representatives.

    Company admins and super admins enter directly. A sales representative may
    unlock the protected area by authenticating as an admin of the same company.
    The unlock is stored only in the session and expires after 30 minutes.
    """
    @login_required
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        user = request.user
        if getattr(user, "is_superadmin", False) or getattr(user, "role", None) == "admin":
            return view_func(request, *args, **kwargs)
        if getattr(user, "role", None) != "sales_person" or getattr(user, "company_id", None) is None:
            messages.error(request, "You do not have access to this page.")
            return redirect("login")
        if _unlock_is_valid(request):
            return view_func(request, *args, **kwargs)
        next_url = request.get_full_path()
        return redirect(f"/admin-unlock/?next={next_url}")
    return wrapper


def sales_user_required(view_func):
    """Company admin and sales representatives may use sales/POS pages."""
    @login_required
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        user = request.user
        if getattr(user, "is_superadmin", False):
            return redirect("superadmin_dashboard")
        if getattr(user, "role", None) not in {"admin", "sales_person"} or getattr(user, "company_id", None) is None:
            messages.error(request, "You do not have access to this page.")
            return redirect("login")
        return view_func(request, *args, **kwargs)
    return wrapper