"""
Decoradores de rol — App Users
================================
Control de acceso basado en roles para las vistas.
"""

from functools import wraps

from django.contrib.auth import REDIRECT_FIELD_NAME
from django.contrib.auth.decorators import login_required
from django.core.exceptions import PermissionDenied
from django.http import JsonResponse


def _is_ajax(request):
    accept = request.headers.get("accept", "")
    return "text/html" not in accept


def _role_required(rol, function=None, redirect_field_name=REDIRECT_FIELD_NAME, login_url=None):
    """
    Decorador base que verifica login + rol específico.
    Retorna JSON 403 para peticiones AJAX, o PermissionDenied HTML para normales.
    """
    def decorator(view_func):
        @wraps(view_func)
        @login_required(redirect_field_name=redirect_field_name, login_url=login_url)
        def _wrapped_view(request, *args, **kwargs):
            if request.user.rol != rol:
                if _is_ajax(request):
                    return JsonResponse({"error": "Não tem permissão para esta ação."}, status=403)
                raise PermissionDenied
            return view_func(request, *args, **kwargs)
        return _wrapped_view

    if function:
        return decorator(function)
    return decorator


def paciente_required(function=None, redirect_field_name=REDIRECT_FIELD_NAME, login_url=None):
    """Solo usuarios con rol PACIENTE pueden acceder."""
    return _role_required(
        "paciente",
        function=function,
        redirect_field_name=redirect_field_name,
        login_url=login_url,
    )


def doctora_required(function=None, redirect_field_name=REDIRECT_FIELD_NAME, login_url=None):
    """Solo usuarios con rol DOCTORA pueden acceder."""
    return _role_required(
        "doctora",
        function=function,
        redirect_field_name=redirect_field_name,
        login_url=login_url,
    )


def admin_required(function=None, redirect_field_name=REDIRECT_FIELD_NAME, login_url=None):
    """Solo usuarios con rol ADMIN pueden acceder."""
    return _role_required(
        "admin",
        function=function,
        redirect_field_name=redirect_field_name,
        login_url=login_url,
    )


def moderador_required(function=None, redirect_field_name=REDIRECT_FIELD_NAME, login_url=None):
    """Usuarios con rol DOCTORA o ADMIN pueden acceder."""
    def decorator(view_func):
        @wraps(view_func)
        @login_required(redirect_field_name=redirect_field_name, login_url=login_url)
        def _wrapped_view(request, *args, **kwargs):
            if request.user.rol not in ("doctora", "admin"):
                if _is_ajax(request):
                    return JsonResponse({"error": "Não tem permissão para esta ação."}, status=403)
                raise PermissionDenied
            return view_func(request, *args, **kwargs)
        return _wrapped_view

    if function:
        return decorator(function)
    return decorator