from rest_framework import generics
from rest_framework.response import Response
from rest_framework.permissions import AllowAny, IsAuthenticated
from rest_framework.views import APIView
from rest_framework.exceptions import PermissionDenied, ValidationError
from django.utils import timezone
from datetime import timedelta
from .models import Invitation, User
from .serializers import UserSerializer, RegisterSerializer

class RegisterView(generics.CreateAPIView):
    queryset = User.objects.all()
    permission_classes = (AllowAny,)
    serializer_class = RegisterSerializer

class UserMeView(generics.RetrieveAPIView):
    permission_classes = (IsAuthenticated,)
    serializer_class = UserSerializer

    def get_object(self):
        return self.request.user


class UserListView(generics.ListAPIView):
    permission_classes = (IsAuthenticated,)
    serializer_class = UserSerializer

    def get_queryset(self):
        if not (self.request.user.is_staff or self.request.user.is_superuser):
            raise PermissionDenied('Seuls les administrateurs peuvent consulter les comptes.')
        return User.objects.order_by('-date_joined')


class UserDetailView(generics.RetrieveUpdateDestroyAPIView):
    permission_classes = (IsAuthenticated,)
    serializer_class = UserSerializer
    lookup_field = 'id'
    lookup_url_kwarg = 'user'

    def get_queryset(self):
        if not (self.request.user.is_staff or self.request.user.is_superuser):
            raise PermissionDenied('Seuls les administrateurs peuvent modifier les comptes.')
        return User.objects.all()

    def update(self, request, *args, **kwargs):
        if not (request.user.is_staff or request.user.is_superuser):
            raise PermissionDenied('Seuls les administrateurs peuvent modifier les comptes.')

        return super().update(request, *args, **kwargs)

    def perform_destroy(self, instance):
        if instance.pk == self.request.user.pk:
            raise ValidationError({'error': 'Vous ne pouvez pas supprimer votre propre compte.'})
        if instance.is_superuser and not self.request.user.is_superuser:
            raise PermissionDenied('Seul un superutilisateur peut supprimer ce compte.')
        instance.delete()


class UserPromoteView(APIView):
    permission_classes = (IsAuthenticated,)

    def post(self, request, user):
        if not (request.user.is_staff or request.user.is_superuser):
            raise PermissionDenied('Seuls les administrateurs peuvent promouvoir des utilisateurs.')
        
        try:
            user_obj = User.objects.get(id=user)
            if user_obj.is_superuser and not request.user.is_superuser:
                raise PermissionDenied('Seul un superutilisateur peut modifier ce compte.')
            user_obj.is_staff = True
            user_obj.save()
            return Response({'message': 'Utilisateur promu avec succès'}, status=200)
        except User.DoesNotExist:
            return Response({'error': 'Utilisateur non trouvé'}, status=404)


class UserDeleteView(UserDetailView):
    http_method_names = ['delete', 'options']


class InvitationCreateView(APIView):
    permission_classes = (IsAuthenticated,)

    def post(self, request):
        if not (request.user.is_staff or request.user.is_superuser):
            raise PermissionDenied('Seuls les administrateurs peuvent créer une invitation.')
        invitation = Invitation.objects.create(
            created_by=request.user,
            expires_at=timezone.now() + timedelta(days=7),
        )
        return Response({
            'token': str(invitation.token),
            'expires_at': invitation.expires_at,
        }, status=201)