import time

from django.conf import settings
from django.contrib.auth import logout
from django.contrib.auth.middleware import LoginRequiredMiddleware
from django.contrib.auth.views import redirect_to_login
from django.http import HttpResponse
from django.urls import reverse
from django.utils.cache import add_never_cache_headers


class PilotLoginRequiredMiddleware(LoginRequiredMiddleware):
    """Use Django's default-deny gate, including full-page HTMX reauthentication."""

    def process_request(self, request):
        expiry = request.session.get("oidc_expires")
        if expiry is not None and (
            expiry <= time.time()
            or request.user.is_staff
            or request.user.is_superuser
            or not settings.NETKINGDOM_ENABLED
            or request.session.get("oidc_binding")
            != [
                settings.NETKINGDOM_ISSUER,
                settings.NETKINGDOM_TENANT,
                settings.NETKINGDOM_CLIENT_ID,
            ]
        ):
            logout(request)

    def handle_no_permission(self, request, view_func):
        if request.headers.get("HX-Request") == "true":
            # The original URL may render only a fragment or accept only POST.
            login = redirect_to_login(reverse("home"), self.get_login_url(view_func))
            return HttpResponse(status=401, headers={"HX-Redirect": login.url})
        return super().handle_no_permission(request, view_func)

    def process_response(self, request, response):
        # Company records and account pages must not survive in shared caches.
        if request.path_info != "/health/":
            add_never_cache_headers(response)
        return response