from django.contrib.auth.decorators import login_required
from django.http import HttpRequest, HttpResponse, HttpResponseForbidden, JsonResponse
from django.shortcuts import render

from coulomb_social.apps.identity import flex_auth


def landing(request: HttpRequest) -> HttpResponse:
    if request.user.is_authenticated:
        from django.shortcuts import redirect

        return redirect("core:app_home")
    return render(request, "core/landing.html")


@login_required
def app_home(request: HttpRequest) -> HttpResponse:
    member = getattr(request.user, "member", None)
    subject = member.subject if member else request.user.get_username()
    tenant = member.tenant_id if member else ""
    decision = flex_auth.check(
        "shell:view",
        resource="shell",
        resource_id="app_home",
        subject=subject,
        tenant=tenant,
        attributes={
            "issuer": member.issuer if member else "",
            "user_engine_user_id": str(member.user_engine_user_id) if member else "",
        },
    )
    if not decision.allow:
        return HttpResponseForbidden(
            f"Not authorized to view shell ({decision.reason})."
        )

    return render(
        request,
        "core/app_home.html",
        {
            "member": member,
            "principal": {
                "username": request.user.get_username(),
                "display_name": (
                    member.display_name
                    if member and member.display_name
                    else request.user.get_full_name() or request.user.get_username()
                ),
                "issuer": member.issuer if member else "",
                "subject": member.subject if member else "",
                "user_engine_user_id": (
                    str(member.user_engine_user_id) if member else ""
                ),
                "tenant_id": member.tenant_id if member else "",
                "user_engine_source": request.session.get("user_engine_source", ""),
                "authz_decision_id": decision.decision_id,
                "authz_reason": decision.reason,
            },
        },
    )


def healthz(_request: HttpRequest) -> JsonResponse:
    return JsonResponse({"status": "ok", "service": "coulomb-social"})