from datetime import datetime, timezone as datetime_timezone

from django.utils import timezone
from django.db import transaction
from rest_framework.exceptions import AuthenticationFailed
from rest_framework_simplejwt.tokens import RefreshToken

from apps.jwt_auth.models import JwtToken


def validate_role_access(role):
    if not (role.cuser and role.cuser.is_active and role.is_active and role.mobile_verify):
        raise AuthenticationFailed('حساب کاربری یا نقش شما غیرفعال است. دوباره وارد شوید.', code='session_invalid')
    workspace = role.sys_ws
    if not workspace or not workspace.is_active or (workspace.expire and workspace.expire <= timezone.now()):
        raise AuthenticationFailed('دسترسی فضای کاری غیرفعال یا منقضی شده است.', code='session_invalid')
    if role.role_type.role_name_en == 'workspace_customer' and role.customer_panel is not True:
        raise AuthenticationFailed('دسترسی شما به پنل مشتریان فعال نیست.', code='session_invalid')


@transaction.atomic
def issue_tokens(role, session=None):
    validate_role_access(role)
    if session is None:
        session = JwtToken.objects.create(cuser=role.cuser, cuser_role=role, refresh='')
    refresh = RefreshToken.for_user(role.cuser)
    refresh['workspace_uuid'] = str(role.sys_ws.uuid)
    refresh['cuser_role_uuid'] = str(role.uuid)
    refresh['user_uuid'] = str(role.cuser.uuid)
    refresh['session_id'] = session.pk
    data = {'refresh': str(refresh), 'access': str(refresh.access_token)}
    session.refresh = data['refresh']
    session.access = data['access']
    session.expire = datetime.fromtimestamp(refresh['exp'], tz=datetime_timezone.utc)
    session.save()
    return data


def validate_session_claims(session, token):
    if session.expire and session.expire <= timezone.now():
        raise AuthenticationFailed('نشست شما منقضی شده است. دوباره وارد شوید.', code='session_invalid')
    role = session.cuser_role
    validate_role_access(role)
    expected = {'user_id': session.cuser_id, 'user_uuid': str(role.cuser.uuid),
                'cuser_role_uuid': str(role.uuid), 'workspace_uuid': str(role.sys_ws.uuid)}
    if token.get('session_id') is not None:
        expected['session_id'] = session.pk
    if role.cuser_id != session.cuser_id or any(token.get(key) != value for key, value in expected.items()):
        raise AuthenticationFailed('نشست شما معتبر نیست. دوباره وارد شوید.', code='session_invalid')