from django.shortcuts import render, redirect, get_object_or_404
from django.contrib.auth import authenticate, login, logout
from django.contrib.auth.models import User
from django.contrib.auth.decorators import login_required, user_passes_test
from django.views.decorators.csrf import csrf_exempt
from django.contrib import messages

def login_view(request):
    # Jika user sudah login, langsung lempar ke dashboard
    if request.user.is_authenticated:
        return redirect('dashboard')

    if request.method == 'POST':
        username_input = request.POST.get('username')
        password_input = request.POST.get('password')

        # authenticate() akan mencoba LDAP Backend dulu, jika gagal/error akan dilanjutkan ke ModelBackend Lokal
        user = authenticate(request, username=username_input, password=password_input)

        if user is not None:
            # 📌 VALIDASI BARU: Cek apakah user berstatus aktif (Sudah di-accept oleh Admin)
            if not user.is_active:
                messages.error(request, "Akun Anda berhasil terdaftar. Harap tunggu persetujuan dari Departmen IT sebelum dapat masuk.")
                return render(request, 'accounts/login.html')

            login(request, user)
            return redirect('dashboard')
        else:
            messages.error(request, "Username atau Password salah, atau akun LDAP Anda kedaluwarsa.")

    return render(request, 'accounts/login.html')

@csrf_exempt
def logout_view(request):
    logout(request)
    return redirect('login')

# -------------------------------------------------------------------
# KODE UNTUK HALAMAN USER ACCOUNTS
# -------------------------------------------------------------------

def is_admin(user):
    return user.is_superuser or user.is_staff

@login_required
@user_passes_test(is_admin)
def user_management_view(request):
    users = User.objects.all().order_by('-date_joined')
    
    for user in users:
        # Cek tipe akun: User LDAP tidak memiliki password terenkripsi usable di DB Django
        if not user.has_usable_password():
            user.account_type = "LDAP"
        else:
            user.account_type = "Lokal"

    return render(request, 'dashboard/user_accounts.html', {'users_list': users})

@login_required
@user_passes_test(is_admin)
def toggle_user_role(request, user_id):
    if request.method == "POST":
        target_user = get_object_or_404(User, id=user_id)
        
        # Mencegah pengguna mengubah role dirinya sendiri
        if target_user == request.user:
            messages.error(request, "Anda tidak bisa mengubah role akun Anda sendiri!")
            return redirect('user_management')

        role = request.POST.get('role')
        
        # 📌 AKSI BARU: Menerima/Mengaktifkan User LDAP Baru
        if role == 'accept':
            target_user.is_active = True
            messages.success(request, f"Akun {target_user.username} telah disetujui dan berhasil diaktifkan.")
        elif role == 'admin':
            target_user.is_staff = True
            target_user.is_superuser = True
            messages.success(request, f"Role {target_user.username} berhasil diubah menjadi Administrator.")
        else:
            target_user.is_staff = False
            target_user.is_superuser = False
            messages.success(request, f"Role {target_user.username} berhasil diubah menjadi User Biasa.")
            
        target_user.save()
        
    return redirect('user_management')