from rest_framework import serializers
from django.contrib.auth import authenticate
from .models import Module, Permission, Role, RolePermission, User


# ==================== AUTH SERIALIZERS ====================
from django.contrib.auth import authenticate, get_user_model



class LoginSerializer(serializers.Serializer):
    email = serializers.EmailField()
    password = serializers.CharField(write_only=True, min_length=6)

    def validate(self, data):
        email = data.get('email')
        password = data.get('password')

        User = get_user_model()

        # Step 1: find user by email
        user_obj = User.objects.filter(email=email).first()
        if not user_obj:
            raise serializers.ValidationError({'error': 'User not found'})

        # Step 2: authenticate using username
        user = authenticate(username=email, password=password)


        if not user:
            raise serializers.ValidationError({'error': 'Invalid password'})

        data['user'] = user
        return data


class LogoutSerializer(serializers.Serializer):
    """Serializer for user logout"""
    pass


class AuthUserSerializer(serializers.ModelSerializer):
    """Serializer for authenticated user response"""
    role_name = serializers.CharField(source='role.name', read_only=True)
    
    class Meta:
        model = User
        fields = ['id', 'email', 'first_name', 'last_name', 'role', 'role_name', 
          'is_active', 'is_staff', 'is_superuser', 'created_at']

    


# ==================== MODULE SERIALIZERS ====================

class ModuleSerializer(serializers.ModelSerializer):
    """Serializer for Module model"""
    class Meta:
        model = Module
        fields = ['id', 'name', 'code', 'description', 'is_active', 'created_at']
        read_only_fields = ['id', 'created_at']


class PermissionSerializer(serializers.ModelSerializer):
    """Serializer for Permission model"""
    module_name = serializers.CharField(source='module.name', read_only=True)
    
    class Meta:
        model = Permission
        fields = ['id', 'module', 'module_name', 'name', 'code', 'description']
        read_only_fields = ['id']


class RolePermissionSerializer(serializers.ModelSerializer):
    """Serializer for RolePermission model"""
    role_name = serializers.CharField(source='role.name', read_only=True)
    permission_name = serializers.CharField(source='permission.name', read_only=True)
    module_name = serializers.CharField(source='permission.module.name', read_only=True)
    
    class Meta:
        model = RolePermission
        fields = ['id', 'role', 'role_name', 'permission', 'permission_name', 'module_name', 'allowed']
        read_only_fields = ['id']


class RoleSerializer(serializers.ModelSerializer):
    """Serializer for Role model"""
    role_permissions = RolePermissionSerializer(many=True, read_only=True)
    
    class Meta:
        model = Role
        fields = ['id', 'name', 'description', 'is_active', 'created_at', 'role_permissions']
        read_only_fields = ['id', 'created_at']


class RoleDetailSerializer(serializers.ModelSerializer):
    """Detailed Serializer for Role model with full permission details"""
    permissions = serializers.SerializerMethodField()
    
    class Meta:
        model = Role
        fields = ['id', 'name', 'description', 'is_active', 'created_at', 'permissions']
        read_only_fields = ['id', 'created_at']
    
    def get_permissions(self, obj):
        role_perms = obj.role_permissions.all()
        return RolePermissionSerializer(role_perms, many=True).data


class UserSerializer(serializers.ModelSerializer):
    """Serializer for User model (read-only password)"""
    role_name = serializers.CharField(source='role.name', read_only=True)
    manager_name = serializers.CharField(source='manager.email', read_only=True)
    
    class Meta:
        model = User
        fields = ['id', 'email', 'first_name', 'last_name', 'role', 'role_name', 
                  'manager', 'manager_name', 'is_active', 'is_staff', 'created_at']
        read_only_fields = ['id', 'created_at', 'is_staff', 'is_superuser']


class UserCreateUpdateSerializer(serializers.ModelSerializer):
    """Serializer for creating and updating User model"""
    password = serializers.CharField(write_only=True, min_length=8)
    password_confirm = serializers.CharField(write_only=True, min_length=8)
    
    class Meta:
        model = User
        fields = ['email', 'first_name', 'last_name', 'password', 'password_confirm', 
                  'role', 'manager', 'is_active']
    
    def validate(self, data):
        """Validate that passwords match"""
        if data.get('password') != data.get('password_confirm'):
            raise serializers.ValidationError({'password': 'Passwords do not match'})
        return data
    
    def create(self, validated_data):
        """Create user with password"""
        validated_data.pop('password_confirm')
        password = validated_data.pop('password')
        email = validated_data.pop('email')
        user = User.objects.create_user(email=email, password=password, **validated_data)
        return user
    
    def update(self, instance, validated_data):
        """Update user, optionally with new password"""
        validated_data.pop('password_confirm', None)
        password = validated_data.pop('password', None)
        
        for attr, value in validated_data.items():
            setattr(instance, attr, value)
        
        if password:
            instance.set_password(password)
        
        instance.save()
        return instance


class UserDetailSerializer(serializers.ModelSerializer):
    """Detailed Serializer for User model"""
    role_details = RoleSerializer(source='role', read_only=True)
    manager_details = UserSerializer(source='manager', read_only=True)
    
    class Meta:
        model = User
        fields = ['id', 'email', 'first_name', 'last_name', 'role', 'role_details',
                  'manager', 'manager_details', 'is_active', 'is_staff', 'is_superuser', 'created_at']
        read_only_fields = ['id', 'created_at', 'is_staff', 'is_superuser']