import uuid
from django.contrib import admin
from django.contrib.auth.admin import UserAdmin as DjangoUserAdmin
from django.contrib.auth.forms import UserChangeForm, UserCreationForm
from django import forms
from .models import User
from .security_models import AccountDeletionRequest, AccountSession


class CanonicalEmailMixin:
    def clean_email(self):
        email = User.objects.normalize_email(self.cleaned_data["email"])
        if User.objects.filter(email__iexact=email).exclude(pk=self.instance.pk).exists():
            raise forms.ValidationError("Email is already in use.")
        return email


class AccountCreationForm(CanonicalEmailMixin, UserCreationForm):
    class Meta(UserCreationForm.Meta):
        model = User
        fields = ("email", "username")


class AccountChangeForm(CanonicalEmailMixin, UserChangeForm):
    class Meta(UserChangeForm.Meta):
        model = User
        fields = "__all__"


@admin.register(User)
class UserAdmin(DjangoUserAdmin):
    add_form = AccountCreationForm
    form = AccountChangeForm
    list_display = ("email", "username", "is_email_verified", "is_active", "is_staff", "date_joined")
    list_filter = ("is_email_verified", "is_active", "is_staff", "is_superuser")
    search_fields = ("email", "username", "display_name")
    ordering = ("-date_joined",)
    readonly_fields = ("id", "is_email_verified", "auth_version", "date_joined", "last_login", "updated_at")
    fieldsets = DjangoUserAdmin.fieldsets + (
        ("Game profile", {"fields": ("display_name", "language", "timezone")}),
        ("Account security", {"fields": ("id", "is_email_verified", "auth_version", "updated_at")}),
    )
    add_fieldsets = ((None, {"classes": ("wide",), "fields": ("email", "username", "password1", "password2")}),)

    def has_delete_permission(self, request, obj=None):
        # Accounts can own clubs, careers and financial history. Deactivate instead.
        return False

    def save_model(self, request, obj, form, change):
        if change and "email" in form.changed_data:
            obj.is_email_verified = False
            obj.auth_version = uuid.uuid4()
        if change and "is_active" in form.changed_data:
            obj.auth_version = uuid.uuid4()
        super().save_model(request, obj, form, change)
        if change and ({'email','is_active'} & set(form.changed_data)):
            from .security_sessions import revoke_all
            revoke_all(obj)


class SecurityEvidenceAdmin(admin.ModelAdmin):
    def has_view_permission(self,request,obj=None):
        return request.user.is_active and request.user.is_superuser
    def has_add_permission(self,request):return False
    def has_change_permission(self,request,obj=None):return False
    def has_delete_permission(self,request,obj=None):return False


@admin.register(AccountDeletionRequest)
class AccountDeletionRequestAdmin(SecurityEvidenceAdmin):
    list_display=('id','user','status','created_at','eligible_after')
    list_filter=('status',)
    readonly_fields=('id','user','status','reason','created_at','eligible_after','resolved_at')


@admin.register(AccountSession)
class AccountSessionAdmin(SecurityEvidenceAdmin):
    list_display=('id','user','method','last_seen_at','expires_at','revoked_at')
    readonly_fields=('id','user','method','user_agent','ip_address','created_at','last_seen_at','expires_at','revoked_at')