"""
Permission Admin - Django admin configuration for permissions and roles.
"""
from django.contrib import admin
from django.utils.html import format_html

from .models import (
    Permission, Role, RolePermission, UserRole, FieldPermission,
    UserPermission, ObjectRelation, RAICPolicy,
)


# ─── Inlines ──────────────────────────────────────────────────

class RolePermissionInline(admin.TabularInline):
    """Inline admin for role permissions."""
    model = RolePermission
    extra = 0
    autocomplete_fields = ['permission']


class FieldPermissionInline(admin.TabularInline):
    """Inline admin for role field permissions."""
    model = FieldPermission
    extra = 0
    fields = ['module', 'resource', 'field_name', 'access_level']


# ─── Permission Admin ────────────────────────────────────────

@admin.register(Permission)
class PermissionAdmin(admin.ModelAdmin):
    """Admin configuration for Permission."""

    list_display = [
        'codename',
        'name',
        'module',
        'resource',
        'action',
        'is_sensitive',
    ]
    list_filter = ['module', 'action', 'is_sensitive']
    search_fields = ['codename', 'name', 'description']
    readonly_fields = ['created_at']

    fieldsets = (
        (None, {
            'fields': ('codename', 'name', 'description')
        }),
        ('Classification', {
            'fields': ('module', 'resource', 'action', 'custom_action', 'is_sensitive')
        }),
        ('Dependencies', {
            'fields': ('requires',),
            'classes': ('collapse',)
        }),
        ('Timestamps', {
            'fields': ('created_at',),
            'classes': ('collapse',)
        }),
    )
    filter_horizontal = ['requires']


# ─── Role Admin ───────────────────────────────────────────────

@admin.register(Role)
class RoleAdmin(admin.ModelAdmin):
    """Admin configuration for Role."""

    list_display = [
        'name',
        'slug',
        'module',
        'is_system',
        'is_active',
        'users_count',
        'created_at',
    ]
    list_filter = ['is_system', 'is_active', 'module']
    search_fields = ['name', 'slug', 'description']
    readonly_fields = ['created_at', 'updated_at']
    prepopulated_fields = {'slug': ('name',)}

    fieldsets = (
        (None, {
            'fields': ('name', 'slug', 'description')
        }),
        ('Type & Status', {
            'fields': ('is_system', 'is_active', 'module')
        }),
        ('Hierarchy', {
            'fields': ('parent',),
            'description': 'This role will inherit all permissions from its parent.'
        }),
        ('Timestamps', {
            'fields': ('created_at', 'updated_at'),
            'classes': ('collapse',)
        }),
    )

    inlines = [RolePermissionInline, FieldPermissionInline]

    def users_count(self, obj):
        """Display count of users with this role."""
        return obj.role_users.count()
    users_count.short_description = 'Users'


# ─── UserRole Admin ──────────────────────────────────────────

@admin.register(UserRole)
class UserRoleAdmin(admin.ModelAdmin):
    """Admin configuration for UserRole."""

    list_display = [
        'user',
        'role',
        'organizational_unit',
        'scope_display',
        'created_at',
    ]
    list_filter = ['role']
    search_fields = ['user__email', 'user__first_name', 'role__name']
    autocomplete_fields = ['user', 'role', 'assigned_by']
    readonly_fields = ['created_at']

    fieldsets = (
        (None, {
            'fields': ('user', 'role')
        }),
        ('Scope', {
            'fields': ('organizational_unit', 'include_descendant_units', 'scope'),
            'description': 'Limit role to specific organizational unit.'
        }),
        ('Validity', {
            'fields': ('starts_at', 'expires_at'),
        }),
        ('Assignment', {
            'fields': ('assigned_by', 'assignment_reason'),
            'classes': ('collapse',)
        }),
        ('Timestamps', {
            'fields': ('created_at',),
            'classes': ('collapse',)
        }),
    )

    def scope_display(self, obj):
        """Display scope type."""
        if obj.organizational_unit:
            return format_html(
                '<span style="color: blue;">OrgUnit: {}</span>',
                obj.organizational_unit.name
            )
        return 'Global'
    scope_display.short_description = 'Scope'


# ─── FieldPermission Admin ───────────────────────────────────

@admin.register(FieldPermission)
class FieldPermissionAdmin(admin.ModelAdmin):
    """Admin configuration for FieldPermission."""

    list_display = [
        'role',
        'module',
        'resource',
        'field_name',
        'access_level',
    ]
    list_filter = ['access_level', 'module']
    search_fields = ['role__name', 'module', 'resource', 'field_name']
    autocomplete_fields = ['role']


# ─── UserPermission Admin ────────────────────────────────────

@admin.register(UserPermission)
class UserPermissionAdmin(admin.ModelAdmin):
    """Admin configuration for UserPermission overrides."""

    list_display = [
        'user', 'permission', 'allow_display', 'reason_short',
        'starts_at', 'expires_at', 'created_at',
    ]
    list_filter = ['allow']
    search_fields = ['user__email', 'permission__codename', 'reason']
    autocomplete_fields = ['user', 'permission', 'granted_by']
    readonly_fields = ['created_at', 'updated_at']

    fieldsets = (
        (None, {
            'fields': ('user', 'permission', 'allow')
        }),
        ('Details', {
            'fields': ('reason', 'granted_by'),
        }),
        ('Validity', {
            'fields': ('starts_at', 'expires_at'),
        }),
        ('Timestamps', {
            'fields': ('created_at', 'updated_at'),
            'classes': ('collapse',)
        }),
    )

    def allow_display(self, obj):
        if obj.allow:
            return format_html('<span style="color: green;">✓ ALLOW</span>')
        return format_html('<span style="color: red;">✗ DENY</span>')
    allow_display.short_description = 'Action'

    def reason_short(self, obj):
        return (obj.reason[:60] + '...') if len(obj.reason) > 60 else obj.reason
    reason_short.short_description = 'Reason'


# ─── ObjectRelation Admin ────────────────────────────────────

@admin.register(ObjectRelation)
class ObjectRelationAdmin(admin.ModelAdmin):
    """Admin configuration for RAIC object relations."""

    list_display = [
        'user', 'relation_type', 'object_type', 'object_id',
        'module', 'created_at',
    ]
    list_filter = ['relation_type', 'module', 'object_type']
    search_fields = ['user__email', 'object_type', 'object_id']
    autocomplete_fields = ['user']
    readonly_fields = ['id', 'created_at']


# ─── RAICPolicy Admin ────────────────────────────────────────

@admin.register(RAICPolicy)
class RAICPolicyAdmin(admin.ModelAdmin):
    """Admin configuration for RAIC policies."""

    list_display = [
        'module', 'object_type', 'relation_type',
        'permission', 'is_active', 'created_at',
    ]
    list_filter = ['module', 'relation_type', 'is_active']
    search_fields = ['module', 'object_type', 'permission__codename']
    autocomplete_fields = ['permission']
    readonly_fields = ['created_at']