from django.contrib.auth.decorators import login_required
from django.core.exceptions import PermissionDenied
from django.core.paginator import Paginator
from django.shortcuts import get_object_or_404, render

from apps.accounts.permissions import (
    ROLE_ACCOUNTS,
    ROLE_HR_ADMIN,
    ROLE_PAYROLL_OFFICER,
    ROLE_SUPER_ADMIN,
    can_access_employee,
    has_role,
    scope_queryset_by_company,
    user_can_access_company,
)
from .models import LoanAccount


def _loan_queryset(user):
    qs = LoanAccount.objects.select_related("employee").prefetch_related("installments", "recoveries").order_by("-created_at")
    qs = scope_queryset_by_company(user, qs, "employee__company")
    if user.is_superuser or has_role(user, ROLE_SUPER_ADMIN, ROLE_HR_ADMIN, ROLE_PAYROLL_OFFICER, ROLE_ACCOUNTS):
        return qs
    employee = getattr(user, "employee_profile", None)
    if employee:
        return qs.filter(employee=employee)
    return qs.none()


@login_required
def facility_list(request):
    page_obj = Paginator(_loan_queryset(request.user), 100).get_page(request.GET.get("page"))
    return render(request, "loans/facility_list.html", {"items": page_obj.object_list, "page_obj": page_obj})


@login_required
def facility_detail(request, pk):
    loan = get_object_or_404(scope_queryset_by_company(request.user, LoanAccount.objects.select_related("employee"), "employee__company"), pk=pk)
    if not (
        request.user.is_superuser
        or has_role(request.user, ROLE_SUPER_ADMIN, ROLE_HR_ADMIN, ROLE_PAYROLL_OFFICER, ROLE_ACCOUNTS)
        or can_access_employee(request.user, loan.employee)
    ):
        raise PermissionDenied("You do not have permission to view this facility.")
    installments = loan.installments.order_by("due_month", "pk")
    recoveries = loan.recoveries.select_related("payroll_record__period").order_by("created_at", "pk")
    return render(request, "loans/facility_detail.html", {"loan": loan, "installments": installments, "recoveries": recoveries})