from django.contrib.auth.decorators import login_required
from django.core.exceptions import PermissionDenied
from django.http import JsonResponse
from django.shortcuts import get_object_or_404,redirect,render
from django.utils.http import url_has_allowed_host_and_scheme
from django.views.decorators.http import require_POST
from .models import Message
from .services import edit_message,soft_delete_message
from apps.tickets.policies import TicketPolicy
def _safe_next(request, fallback):
    value=request.POST.get("next")
    return value if value and url_has_allowed_host_and_scheme(value,allowed_hosts={request.get_host()},require_https=request.is_secure()) else fallback
@login_required
@require_POST
def edit(request,public_id):
    msg=get_object_or_404(Message,public_id=public_id)
    try: edit_message(msg.pk,request.user,request.POST.get("body",""))
    except (PermissionDenied,ValueError) as exc: raise PermissionDenied(str(exc))
    return redirect(_safe_next(request,"/tickets/"))
@login_required
@require_POST
def delete(request,public_id):
    msg=get_object_or_404(Message,public_id=public_id); soft_delete_message(msg.pk,request.user); return redirect(_safe_next(request,"/staff/"))
@login_required
def revisions(request,public_id):
    from apps.tickets.dispatch_responses import can_read_response
    msg=get_object_or_404(Message,public_id=public_id)
    if not can_read_response(request.user, msg): raise PermissionDenied
    if not request.user.has_perm("messaging.view_message_revisions") or not TicketPolicy.can_view(request.user,msg.ticket): raise PermissionDenied
    return render(request,"messaging/revisions.html",{"message":msg,"revisions":msg.revisions.select_related("edited_by")})