"""Administration of users and shared spaces, without access to personal files."""
from django.contrib import admin
from django.db.models import Q
from .models import DriveSpace, SpaceInvitation, SpaceGrant


@admin.register(DriveSpace)
class SpaceAdmin(admin.ModelAdmin):
    list_display = ('id', 'display_name', 'user', 'parent', 'can_view_parent', 'can_write_parent', 'can_invite', 'quota_bytes')
    search_fields = ('display_name', 'user__username')
    readonly_fields = ('directory_name', 'relative_path')

    def get_readonly_fields(self, request, obj=None):
        base = super().get_readonly_fields(request, obj)
        if obj and obj.private_owner_id:
            return tuple(base) + ('quota_bytes', 'parent', 'private_owner')
        return base

    def get_queryset(self, request):
        # Private spaces from other users never appear, even for a superuser.
        return super().get_queryset(request).filter(
            Q(private_owner__isnull=True) | Q(private_owner=request.user)
        )

    def _personal_other(self, request, obj):
        return bool(obj and obj.private_owner_id and obj.private_owner_id != request.user.pk)

    def has_view_permission(self, request, obj=None):
        return not self._personal_other(request, obj) and super().has_view_permission(request, obj)

    def has_change_permission(self, request, obj=None):
        return not self._personal_other(request, obj) and super().has_change_permission(request, obj)

    def has_delete_permission(self, request, obj=None):
        return not self._personal_other(request, obj) and super().has_delete_permission(request, obj)


@admin.register(SpaceInvitation)
class InvitationAdmin(admin.ModelAdmin):
    list_display = ('id', 'parent_space', 'created_by', 'expires_at', 'quota_bytes', 'used_at', 'revoked_at')
    readonly_fields = ('token_hash',)


@admin.register(SpaceGrant)
class SpaceGrantAdmin(admin.ModelAdmin):
    list_display = ('space', 'user', 'can_write', 'can_invite')

# DriveItem and UploadSession must NOT be exposed in the Django admin:
# they contain personal file names and private upload metadata.