from django.contrib import admin
from django.db.models import Q

from apps.accounts.admin_utils import CompanyScopedAdminMixin
from apps.accounts.permissions import accessible_company_ids
from .models import EmployeeRequest, ManagementNotice, NoticeRecipient, Notification, WorkflowTask


class EmployeeRequestAdmin(CompanyScopedAdminMixin, admin.ModelAdmin):
    company_lookup = "employee__company"
    fk_company_lookups = {"employee": "company"}
    list_display = ("reference_no", "employee", "request_type", "status", "created_at")
    list_filter = ("status", "request_type")
    search_fields = ("reference_no", "employee__employee_code", "employee__full_name", "subject")


class WorkflowTaskAdmin(CompanyScopedAdminMixin, admin.ModelAdmin):
    company_lookup = "company"
    fk_company_lookups = {"assigned_to": "company_accesses__company"}
    list_display = ("reference_no", "module", "title", "assigned_to", "assigned_role", "status", "priority")
    list_filter = ("company", "module", "status", "priority")
    search_fields = ("reference_no", "title", "assigned_to__username")


class ManagementNoticeAdmin(CompanyScopedAdminMixin, admin.ModelAdmin):
    company_lookup = "company"
    list_display = ("title", "company", "audience", "publish_from", "publish_until")
    list_filter = ("company", "audience")


class NoticeRecipientAdmin(CompanyScopedAdminMixin, admin.ModelAdmin):
    company_lookup = "notice__company"
    fk_company_lookups = {"notice": "company", "employee": "company"}
    list_display = ("notice", "employee", "read_at")
    search_fields = ("notice__title", "employee__employee_code", "employee__full_name")


admin.site.register(EmployeeRequest, EmployeeRequestAdmin)
admin.site.register(WorkflowTask, WorkflowTaskAdmin)
admin.site.register(ManagementNotice, ManagementNoticeAdmin)
admin.site.register(NoticeRecipient, NoticeRecipientAdmin)


@admin.register(Notification)
class NotificationAdmin(admin.ModelAdmin):
    list_display = ("recipient", "title", "module", "reference_no", "read_at", "created_at")
    search_fields = ("recipient__username", "title", "reference_no")

    def get_queryset(self, request):
        qs = super().get_queryset(request)
        if request.user.is_superuser:
            return qs
        ids = accessible_company_ids(request.user)
        if not ids:
            return qs.none()
        return qs.filter(
            Q(recipient__company_accesses__company_id__in=ids, recipient__company_accesses__is_active=True)
            | Q(recipient__employee_profile__company_id__in=ids)
        ).distinct()

    def _object_allowed(self, request, obj):
        return obj is None or self.get_queryset(request).filter(pk=obj.pk).exists()

    def has_view_permission(self, request, obj=None):
        return self._object_allowed(request, obj) and super().has_view_permission(request, obj)

    def has_change_permission(self, request, obj=None):
        return self._object_allowed(request, obj) and super().has_change_permission(request, obj)

    def has_delete_permission(self, request, obj=None):
        return self._object_allowed(request, obj) and super().has_delete_permission(request, obj)

    def has_add_permission(self, request):
        # Notifications must be created by business workflows so a tenant context
        # and audit trail always exist. Django Admin is read/maintenance only.
        return request.user.is_superuser and super().has_add_permission(request)