from django.contrib.auth.models import Group
from django.urls import reverse
from rest_framework import status
from rest_framework.authtoken.models import Token
from rest_framework.test import APITestCase

from apps.account.models import User


class AdminPanelAccessTests(APITestCase):
    def setUp(self):
        self.student_group = Group.objects.create(name="Student Group")
        self.professor_group = Group.objects.create(name="Professor Group")
        self.admin_group = Group.objects.create(name="Admin Group")
        self.super_admin_group = Group.objects.create(name="Super Admin Group")

        self.super_admin = User.objects.create_superuser(
            email="superadmin@example.com",
            password="SuperSecret123!",
            fullname="Super Admin",
        )
        self.super_admin.language = None
        self.super_admin.save()
        self.super_admin_token = Token.objects.create(user=self.super_admin)

    def _create_user(self, **kwargs):
        password = kwargs.pop("password")
        user = User.objects.create_user(password=password, **kwargs)
        user.language = None
        user.save()
        return user

    def test_student_with_staff_flag_cannot_login_to_admin_panel(self):
        user = self._create_user(
            email="student@example.com",
            password="StudentPass123!",
            fullname="Student User",
            user_type=User.UserType.STUDENT,
            is_staff=True,
        )

        response = self.client.post(
            reverse("admin-login"),
            {"email": user.email, "password": "StudentPass123!"},
            format="json",
        )

        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)

    def test_professor_can_login_to_admin_panel(self):
        professor = self._create_user(
            email="professor@example.com",
            password="ProfessorPass123!",
            fullname="Professor User",
            user_type=User.UserType.PROFESSOR,
        )
        professor.add_role("professor")

        response = self.client.post(
            reverse("admin-login"),
            {"email": professor.email, "password": "ProfessorPass123!"},
            format="json",
        )

        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
        self.assertEqual(response.data["user_type"], "professor")

    def test_admin_can_login_to_admin_panel(self):
        admin = self._create_user(
            email="admin@example.com",
            password="AdminPass123!",
            fullname="Admin User",
            user_type=User.UserType.ADMIN,
        )
        admin.add_role("admin")

        response = self.client.post(
            reverse("admin-login"),
            {"email": admin.email, "password": "AdminPass123!"},
            format="json",
        )

        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
        self.assertEqual(response.data["user_type"], "admin")

    def test_updating_user_to_student_revokes_panel_access(self):
        target_user = self._create_user(
            email="target@example.com",
            password="TargetPass123!",
            fullname="Target User",
            user_type=User.UserType.PROFESSOR,
            is_staff=True,
        )
        target_user.add_role("professor")
        target_user.add_role("admin")
        target_user.is_superuser = True
        target_user.save(update_fields=["is_superuser", "is_staff"])

        self.client.credentials(HTTP_AUTHORIZATION=f"Token {self.super_admin_token.key}")
        update_response = self.client.patch(
            reverse("admin-users-detail", args=[target_user.id]),
            {
                "user_type": User.UserType.STUDENT,
                "is_staff": True,
                "is_superuser": True,
            },
            format="json",
        )

        self.assertEqual(update_response.status_code, status.HTTP_200_OK)

        target_user.refresh_from_db()
        self.assertEqual(target_user.user_type, User.UserType.STUDENT)
        self.assertFalse(target_user.is_staff)
        self.assertFalse(target_user.is_superuser)
        self.assertFalse(target_user.has_role("professor"))
        self.assertFalse(target_user.has_role("admin"))

        self.client.credentials()
        login_response = self.client.post(
            reverse("admin-login"),
            {"email": target_user.email, "password": "TargetPass123!"},
            format="json",
        )
        self.assertEqual(login_response.status_code, status.HTTP_401_UNAUTHORIZED)