"""
Permission helpers and mixins for role-based access control.
"""
from django.contrib.auth.mixins import LoginRequiredMixin
from django.shortcuts import redirect
from django.contrib import messages


def can_manage_admissions(user):
    """Admin or accounts staff can approve/reject enrollment payments."""
    return bool(user.is_authenticated and user.role in ('admin', 'accounts_staff'))


def can_view_fees(user):
    """Admin or accounts staff can see fees, prices due, and earnings-related data."""
    return bool(user.is_authenticated and user.role in ('admin', 'accounts_staff'))


def can_manage_payments(user):
    """Admin or accounts staff can approve payment proofs (courses & certifications)."""
    return bool(user.is_authenticated and user.role in ('admin', 'accounts_staff'))


def can_manage_tickets(user):
    """Admin or support staff can view all tickets and reply as staff."""
    return bool(user.is_authenticated and user.role in ('admin', 'support_staff'))


def can_delete_tickets(user):
    """Only admin can permanently delete tickets."""
    return bool(user.is_authenticated and user.role == 'admin')


def can_manage_settings(user):
    """Only admin (super admin) can change academy/theme settings."""
    return bool(user.is_authenticated and user.role == 'admin')


class RoleRequiredMixin(LoginRequiredMixin):
    """Mixin that restricts access based on user role."""
    allowed_roles = []

    def dispatch(self, request, *args, **kwargs):
        if not request.user.is_authenticated:
            return self.handle_no_permission()
        if self.allowed_roles and request.user.role not in self.allowed_roles:
            messages.error(request, "You do not have permission to access this page.")
            return redirect('dashboard:redirect')
        return super().dispatch(request, *args, **kwargs)


class AdminRequiredMixin(RoleRequiredMixin):
    """Mixin that restricts access to admin users only."""
    allowed_roles = ['admin']


class TeacherRequiredMixin(RoleRequiredMixin):
    """Mixin that restricts access to teacher users only."""
    allowed_roles = ['teacher']


class StudentRequiredMixin(RoleRequiredMixin):
    """Mixin that restricts access to student users only."""
    allowed_roles = ['student']


class SupportStaffRequiredMixin(RoleRequiredMixin):
    """Mixin that restricts access to support staff only."""
    allowed_roles = ['support_staff']


class AccountsStaffRequiredMixin(RoleRequiredMixin):
    """Mixin that restricts access to accounts staff only."""
    allowed_roles = ['accounts_staff']


class AdminOrTeacherMixin(RoleRequiredMixin):
    """Mixin that allows both admin and teacher users."""
    allowed_roles = ['admin', 'teacher']


class AdminOrSupportStaffMixin(RoleRequiredMixin):
    """Admin or support staff — tickets and support inbox."""
    allowed_roles = ['admin', 'support_staff']


class AdminOrAccountsStaffMixin(RoleRequiredMixin):
    """Admin or accounts staff — fees, payments, and financial review."""
    allowed_roles = ['admin', 'accounts_staff']


class CertificateStaffMixin(RoleRequiredMixin):
    """Admin, accounts, or support — view/print issued certificates (not fee approval)."""
    allowed_roles = ['admin', 'accounts_staff', 'support_staff']


class ProctorStaffMixin(RoleRequiredMixin):
    """Admin, teacher, or support staff — live certification proctor sessions."""
    allowed_roles = ['admin', 'teacher', 'support_staff']