from django.contrib.auth.models import Group, Permission
from django.contrib.contenttypes.models import ContentType
from django.core.management.base import BaseCommand

from apps.core.authentication.models import CustomUser
from apps.core.permissions.roles import UserRole
from apps.rims.grants.models import RimsCapability


class Command(BaseCommand):
    help = "Create Django auth groups for each IILMP role (idempotent)."

    def handle(self, *args, **options):
        for role in UserRole:
            group, created = Group.objects.get_or_create(name=role.value)
            if created:
                self.stdout.write(self.style.SUCCESS(f"Created group: {group.name}"))
            else:
                self.stdout.write(f"Group exists: {group.name}")

        ct = ContentType.objects.get_for_model(CustomUser)
        for role in (UserRole.ADMIN, UserRole.SYSTEM_ADMIN):
            role_group = Group.objects.filter(name=role.value).first()
            if role_group:
                for codename in ("manage_users", "manage_role_permissions", "view_rep_job_applications"):
                    perm = Permission.objects.filter(content_type=ct, codename=codename).first()
                    if perm:
                        role_group.permissions.add(perm)
                self.stdout.write(
                    self.style.SUCCESS(
                        f"Attached core user-management and REP job-application permissions to {role.value}.",
                    ),
                )
            else:
                self.stdout.write(self.style.WARNING(f"{role.value} role group missing; skipped core attach."))

        self._attach_rims_permissions()
        # REP LMS permission seeding (manage_courses/manage_content/…) was removed
        # with the REP platform; learning is on Moodle now.
        self._attach_core_career_permissions(ct)

    def _attach_core_career_permissions(self, user_ct):
        """REP job board: who may review submitted applications (beyond listing poster)."""
        by_codename = {p.codename: p for p in Permission.objects.filter(content_type=user_ct)}
        perm = by_codename.get("view_rep_job_applications")
        if not perm:
            self.stdout.write(
                self.style.WARNING(
                    "core.view_rep_job_applications missing — run migrations before seed_roles.",
                ),
            )
            return
        for role in (
            UserRole.GRANTS_MANAGER,
            UserRole.REP_LEARNING_ADMIN,
            UserRole.SYSTEM_ADMIN,
            UserRole.PROGRAM_MANAGER,
        ):
            g = Group.objects.filter(name=role.value).first()
            if g:
                g.permissions.add(perm)
                self.stdout.write(
                    self.style.SUCCESS(
                        f"Attached core.view_rep_job_applications to {role.value} role group.",
                    ),
                )

    def _attach_rims_permissions(self):
        rims_ct = ContentType.objects.get_for_model(RimsCapability)
        by_codename = {
            p.codename: p for p in Permission.objects.filter(content_type=rims_ct)
        }

        def add_perms(group_name: str, codenames: tuple[str, ...]) -> None:
            g = Group.objects.filter(name=group_name).first()
            if not g:
                self.stdout.write(self.style.WARNING(f"Group {group_name!r} missing; skipped RIMS perms."))
                return
            for c in codenames:
                p = by_codename.get(c)
                if p:
                    g.permissions.add(p)
            self.stdout.write(f"RIMS permissions for {group_name}: {', '.join(codenames)}")

        all_rims = tuple(by_codename.keys())
        if not all_rims:
            self.stdout.write(
                self.style.WARNING(
                    "No rims_grants permissions found — run migrations (RimsCapability) before seed_roles.",
                ),
            )
            return

        add_perms(
            UserRole.ADMIN.value,
            (
                "view_dashboard",
                "manage_calls",
                "review_applications",
                "manage_operations",
                "manage_finance",
                "manage_projects",
                "manage_scholarships",
                "approve_grants",
            ),
        )
        add_perms(
            UserRole.SYSTEM_ADMIN.value,
            (
                "view_dashboard",
                "manage_calls",
                "review_applications",
                "manage_operations",
                "manage_finance",
                "manage_projects",
                "manage_scholarships",
                "approve_grants",
            ),
        )
        add_perms(
            UserRole.GRANTS_MANAGER.value,
            (
                "view_dashboard",
                "manage_calls",
                "review_applications",
                "manage_operations",
                "manage_finance",
                "manage_projects",
                "manage_scholarships",
            ),
        )
        add_perms(
            UserRole.PROGRAM_MANAGER.value,
            (
                "view_dashboard",
                "manage_calls",
                "review_applications",
                "manage_operations",
                "manage_projects",
            ),
        )
        add_perms(
            UserRole.PROGRAM_DIRECTOR.value,
            ("view_dashboard", "manage_calls", "approve_grants"),
        )
        add_perms(
            UserRole.FINANCE_OFFICER.value,
            ("view_dashboard", "manage_finance", "manage_projects"),
        )
        add_perms(
            UserRole.FINANCE_DIRECTOR.value,
            ("view_dashboard", "manage_finance", "manage_projects", "approve_grants"),
        )
        add_perms(UserRole.REVIEWER.value, ("review_applications",))
        add_perms(UserRole.MEL_OFFICER.value, ("view_dashboard",))

        # Funding-administration org chart additions.
        add_perms(UserRole.GRANTS_VALIDATOR.value, ("review_applications", "approve_grants"))
        add_perms(UserRole.PRINCIPAL_INVESTIGATOR.value, ("view_dashboard", "manage_projects"))
        add_perms(
            UserRole.SCHOLARSHIP_MANAGER.value,
            ("view_dashboard", "manage_calls", "manage_scholarships", "review_applications"),
        )
        add_perms(UserRole.SCHOLARSHIP_REVIEWER.value, ("review_applications",))
        add_perms(UserRole.SCHOLARSHIP_VALIDATOR.value, ("review_applications", "approve_grants"))
        add_perms(UserRole.PLANNING_MONITORING_EVALUATION.value, ("view_dashboard",))
        add_perms(UserRole.HUMAN_RESOURCE.value, ("view_dashboard",))
        # SCHOLARSHIP_HOME_VALIDATOR is gated purely by role in HomeValidatorMixin
        # (apps/rims/grants/views.py) — same pattern as FINANCE_MANAGER/PROJECT_MANAGER,
        # no standalone RimsCapability permission needed.