from functools import wraps
from django.shortcuts import redirect
from django.http import HttpResponseForbidden
from django.contrib import messages


def cms_required(view_func):
    """Allow only CMS users (super_admin, admin, manager)."""
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect(f'/cms/login/?next={request.path}')
        if not request.user.is_cms_user:
            messages.error(request, 'You do not have permission to access the CMS.')
            return redirect('home')
        return view_func(request, *args, **kwargs)
    return wrapper


def admin_required(view_func):
    """Allow only admin / super_admin."""
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect(f'/cms/login/?next={request.path}')
        if not request.user.is_admin:
            messages.error(request, 'Admin access required.')
            return redirect('cms_dashboard')
        return view_func(request, *args, **kwargs)
    return wrapper


def super_admin_required(view_func):
    """Allow only super_admin."""
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect(f'/cms/login/?next={request.path}')
        if not request.user.is_super_admin:
            messages.error(request, 'Super Admin access required.')
            return redirect('cms_dashboard')
        return view_func(request, *args, **kwargs)
    return wrapper


def module_required(module_key):
    """
    Restrict a CMS view to tenants that have the given module enabled.
    Super admins (YOUR COMPANY staff) are always allowed through.
    Returns 403 for tenant users whose plan does not include the module.

    Usage:
        @module_required('ecommerce')
        def cms_orders(request): ...
    """
    def decorator(view_func):
        @wraps(view_func)
        def wrapper(request, *args, **kwargs):
            if not request.user.is_authenticated:
                return redirect(f'/cms/login/?next={request.path}')
            # Super admins always bypass module restrictions
            if getattr(request.user, 'is_super_admin', False):
                return view_func(request, *args, **kwargs)
            tenant = getattr(request, 'tenant', None)
            if tenant and not tenant.has_module(module_key):
                return HttpResponseForbidden(
                    f'<h2 style="font-family:sans-serif;padding:3rem;color:#dc2626">'
                    f'This feature is not included in your current plan.<br>'
                    f'<small style="font-size:.8rem;color:#6b7280">Module: {module_key}</small>'
                    f'</h2>'
                )
            return view_func(request, *args, **kwargs)
        return wrapper
    return decorator