from django.conf import settings
from django.contrib.auth.decorators import login_required
from django.db import connection
from django.http import JsonResponse


def health(request):
    db_ok = True
    try:
        with connection.cursor() as cursor:
            cursor.execute("SELECT 1")
            cursor.fetchone()
    except Exception:
        db_ok = False
    return JsonResponse({"status": "ok" if db_ok else "degraded", "database": db_ok})


@login_required
def backend_status(request):
    return JsonResponse({
        "project": settings.PROJECT_REFERENCE,
        "version": settings.APP_VERSION,
        "database_layer": "production schema, operational workflows, secured access paths and backup/restore runtime commands prepared",
        "bound_screens": ["login", "password_change", "dashboard", "employees", "attendance", "leave", "applications", "tasks", "notifications", "salary", "payroll", "loans", "exit_clearance", "payslips", "reports", "system_operations"],
        "modules": ["accounts", "organization", "employees", "attendance", "leave", "workflow", "payroll", "loans", "exits", "audit", "imports", "reports"],
    })


@login_required
def dashboard(request):
    from django.db.models import Count
    from django.utils import timezone
    from apps.employees.models import Employee
    from apps.workflow.models import WorkflowTask
    from apps.payroll.models import PayrollPeriod
    from apps.attendance.models import AttendanceRecord

    from apps.accounts.permissions import accessible_company_ids
    company_ids = accessible_company_ids(request.user)
    employees = Employee.objects.filter(company_id__in=company_ids)
    if not request.user.is_superuser and not request.user.groups.filter(name__in=["Super Admin", "HR Admin", "Payroll Officer"]).exists():
        own = getattr(request.user, "employee_profile", None)
        if request.user.groups.filter(name="Manager").exists() and own:
            employees = employees.filter(reporting_manager=own)
        elif own:
            employees = employees.filter(pk=own.pk)
        else:
            employees = employees.none()

    open_tasks = WorkflowTask.objects.filter(status=WorkflowTask.Status.OPEN, company_id__in=company_ids)
    if not request.user.is_superuser and not request.user.groups.filter(name__in=["Super Admin", "HR Admin"]).exists():
        roles = list(request.user.groups.values_list("name", flat=True))
        from django.db.models import Q
        open_tasks = open_tasks.filter(Q(assigned_to=request.user) | Q(assigned_role__in=roles))

    today = timezone.localdate()
    today_attendance_qs = (AttendanceRecord.objects
        .filter(work_date=today, employee__in=employees)
        .select_related("employee")
        .order_by("employee__employee_code"))
    attendance_total = today_attendance_qs.count()
    present_today = today_attendance_qs.filter(status=AttendanceRecord.Status.PRESENT).count()
    absent_today = today_attendance_qs.filter(status=AttendanceRecord.Status.ABSENT).count()
    leave_today = today_attendance_qs.filter(status=AttendanceRecord.Status.LEAVE).count()
    late_today = today_attendance_qs.filter(status=AttendanceRecord.Status.LATE).count()
    attendance_rate = round(((present_today + late_today) / attendance_total) * 100) if attendance_total else 0
    absent_rate = round((absent_today / attendance_total) * 100) if attendance_total else 0

    department_summary = list(
        employees.values("department__name").annotate(count=Count("id")).order_by("-count", "department__name")[:8]
    )
    employee_count = employees.count()
    for row in department_summary:
        row["percent"] = round((row["count"] / employee_count) * 100) if employee_count else 0

    context = {
        "today": today,
        "employee_count": employee_count,
        "open_task_count": open_tasks.count(),
        "latest_payroll": PayrollPeriod.objects.filter(company_id__in=company_ids).order_by("-year", "-month").first(),
        "recent_employees": employees.select_related("department", "designation", "branch")[:8],
        "today_attendance": today_attendance_qs[:8],
        "attendance_total_today": attendance_total,
        "present_today": present_today,
        "absent_today": absent_today,
        "leave_today": leave_today,
        "late_today": late_today,
        "attendance_rate": attendance_rate,
        "absent_rate": absent_rate,
        "department_summary": department_summary,
    }
    from django.shortcuts import render
    return render(request, "dashboard.html", context)


@login_required
def system_operations(request):
    if not request.user.is_superuser:
        from django.core.exceptions import PermissionDenied
        raise PermissionDenied("System Operations is restricted to Super Admin.")
    from django.conf import settings
    from django.shortcuts import render
    from .runtime_checks import security_readiness_checks
    backup_dir = settings.BACKUP_DIR
    try:
        backups = sorted(backup_dir.glob("*.dump"), key=lambda p: p.stat().st_mtime, reverse=True)[:10]
    except OSError:
        backups = []
    return render(request, "core/system_operations.html", {
        "checks": security_readiness_checks(),
        "backup_dir": backup_dir,
        "retention_days": settings.BACKUP_RETENTION_DAYS,
        "backups": backups,
    })


@login_required
def local_runtime_status(request):
    if not request.user.is_superuser:
        from django.core.exceptions import PermissionDenied
        raise PermissionDenied("Local Runtime status is restricted to Super Admin.")
    from django.conf import settings
    from django.contrib.auth import get_user_model
    from django.contrib.auth.models import Group
    from django.db import connection
    from django.shortcuts import render
    from apps.attendance.models import AttendanceDevice
    from apps.employees.models import Employee
    from apps.organization.models import Company

    checks = []
    try:
        with connection.cursor() as cursor:
            cursor.execute("SELECT 1")
            cursor.fetchone()
        checks.append({"name": "Database connection", "ok": True})
    except Exception:
        checks.append({"name": "Database connection", "ok": False})
    checks.extend([
        {"name": "Shohoj Shop seed", "ok": Company.objects.filter(code="SHOHOJ").exists()},
        {"name": "Standard roles", "ok": Group.objects.filter(name="HR Admin").exists()},
        {"name": "Super Admin", "ok": get_user_model().objects.filter(is_superuser=True).exists()},
        {"name": "ZKTeco FO-M1 profile", "ok": AttendanceDevice.objects.filter(model__iexact="FO-M1").exists()},
        {"name": "UAT sample employees", "ok": Employee.objects.filter(employee_code__startswith="SSCL-").exists()},
    ])
    return render(request, "core/local_runtime_status.html", {
        "checks": checks,
        "db_engine": settings.DATABASES["default"]["ENGINE"],
        "app_version": settings.APP_VERSION,
        "project_reference": settings.PROJECT_REFERENCE,
    })


@login_required
def administration_hub(request):
    from django.core.exceptions import PermissionDenied
    from apps.accounts.permissions import ROLE_HR_ADMIN, ROLE_SUPER_ADMIN, has_role
    if not (request.user.is_superuser or has_role(request.user, ROLE_SUPER_ADMIN, ROLE_HR_ADMIN)):
        raise PermissionDenied("Administration is restricted to HR/Super Admin.")
    from django.contrib.auth import get_user_model
    from django.contrib.auth.models import Group
    from django.shortcuts import render
    from apps.organization.models import Branch, Department, Designation, Shift
    from apps.audit.models import AuditLog
    from apps.accounts.permissions import accessible_company_ids
    company_ids = accessible_company_ids(request.user)
    return render(request, "core/administration_hub.html", {
        "user_count": get_user_model().objects.filter(company_accesses__company_id__in=company_ids).distinct().count(),
        "role_count": Group.objects.count(),
        "branch_count": Branch.objects.filter(company_id__in=company_ids).count(),
        "department_count": Department.objects.filter(company_id__in=company_ids).count(),
        "designation_count": Designation.objects.filter(company_id__in=company_ids).count(),
        "shift_count": Shift.objects.filter(company_id__in=company_ids).count(),
        "audit_count": AuditLog.objects.filter(company_id__in=company_ids).count(),
    })


@login_required
def audit_logs(request):
    from django.core.exceptions import PermissionDenied
    from apps.accounts.permissions import ROLE_HR_ADMIN, ROLE_SUPER_ADMIN, has_role
    if not (request.user.is_superuser or has_role(request.user, ROLE_SUPER_ADMIN, ROLE_HR_ADMIN)):
        raise PermissionDenied("Audit logs are restricted to HR/Super Admin.")
    from django.shortcuts import render
    from apps.audit.models import AuditLog
    q = request.GET.get("q", "").strip()
    from apps.accounts.permissions import accessible_company_ids
    logs = AuditLog.objects.select_related("user", "company")
    if not request.user.is_superuser:
        logs = logs.filter(company_id__in=accessible_company_ids(request.user))
    if q:
        from django.db.models import Q
        logs = logs.filter(Q(module__icontains=q) | Q(action__icontains=q) | Q(object_repr__icontains=q) | Q(user__username__icontains=q))
    return render(request, "core/audit_logs.html", {"logs": logs[:500], "q": q})


@login_required
def migration_center(request):
    from django.core.exceptions import PermissionDenied
    from apps.accounts.permissions import ROLE_HR_ADMIN, ROLE_SUPER_ADMIN, has_role
    if not (request.user.is_superuser or has_role(request.user, ROLE_SUPER_ADMIN, ROLE_HR_ADMIN)):
        raise PermissionDenied("Migration center is restricted to HR/Super Admin.")
    from django.shortcuts import render
    from apps.imports.models import ImportJob
    from apps.accounts.permissions import accessible_company_ids
    jobs = ImportJob.objects.select_related("created_by", "company").filter(company_id__in=accessible_company_ids(request.user)).order_by("-created_at")[:100]
    return render(request, "core/migration_center.html", {"jobs": jobs})