from rest_framework import viewsets, permissions, status
from rest_framework.decorators import action
from rest_framework.response import Response
from django_filters.rest_framework import DjangoFilterBackend
from rest_framework.filters import SearchFilter

from account.models import Role, Permission
from account.serializers.roles import RoleSerializer, RoleListSerializer, PermissionSerializer


class PermissionViewSet(viewsets.ReadOnlyModelViewSet):
    """
    ViewSet for viewing permissions (read-only).
    Only admin users can view permissions.
    """
    queryset = Permission.objects.all()
    serializer_class = PermissionSerializer
    permission_classes = [permissions.IsAuthenticated]
    filter_backends = [DjangoFilterBackend, SearchFilter]
    filterset_fields = ['codename']
    search_fields = ['name', 'codename', 'description']

    def get_queryset(self):
        # Regular users can see permissions, but only admins can manage them
        return Permission.objects.all()


class RoleViewSet(viewsets.ModelViewSet):
    """
    ViewSet for managing roles.
    Only admin/superuser can create/edit/delete roles.
    """
    queryset = Role.objects.all().prefetch_related('permissions')
    permission_classes = [permissions.IsAuthenticated]
    filter_backends = [DjangoFilterBackend, SearchFilter]
    filterset_fields = ['name']
    search_fields = ['name', 'description']

    def get_serializer_class(self):
        if self.action == 'list':
            return RoleListSerializer
        return RoleSerializer

    def get_queryset(self):
        # All authenticated users can view roles, but only admins can modify
        return Role.objects.all().prefetch_related('permissions')

    def create(self, request, *args, **kwargs):
        """Only admins can create roles"""
        if not request.user.is_staff:
            return Response(
                {"error": "Only admin users can create roles."},
                status=status.HTTP_403_FORBIDDEN
            )
        return super().create(request, *args, **kwargs)

    def update(self, request, *args, **kwargs):
        """Only admins can update roles"""
        if not request.user.is_staff:
            return Response(
                {"error": "Only admin users can update roles."},
                status=status.HTTP_403_FORBIDDEN
            )
        return super().update(request, *args, **kwargs)

    def destroy(self, request, *args, **kwargs):
        """Only admins can delete roles"""
        if not request.user.is_staff:
            return Response(
                {"error": "Only admin users can delete roles."},
                status=status.HTTP_403_FORBIDDEN
            )
        return super().destroy(request, *args, **kwargs)