"""User-account services for the controlled demo environment."""

from django.contrib.auth import authenticate, get_user_model, login, logout
from django.contrib.auth.password_validation import validate_password
from django.core.exceptions import ValidationError
from django.db import transaction

User = get_user_model()


@transaction.atomic
def register_user(username: str, password: str, role: str) -> dict:
    username = (username or "").strip()
    if not username:
        raise ValidationError("Username is required.")
    if role not in {"admin", "user"}:
        raise ValidationError("Role must be admin or user.")
    if User.objects.filter(username=username).exists():
        raise ValidationError("This username already exists.")

    validate_password(password)
    is_admin = role == "admin"
    User.objects.create_user(
        username=username,
        password=password,
        is_superuser=is_admin,
        is_staff=is_admin,
    )
    return {"status": "success", "message": "User created successfully."}


@transaction.atomic
def delete_user(request, user_id: int) -> dict:
    if request.user.id == user_id:
        raise ValidationError("You cannot delete your own account.")
    user = User.objects.get(id=user_id)
    user.delete()
    return {"status": "success", "message": "User deleted successfully."}


@transaction.atomic
def set_password(user_id: int, new_password: str) -> dict:
    user = User.objects.get(id=user_id)
    validate_password(new_password, user)
    user.set_password(new_password)
    user.save(update_fields=["password"])
    return {"status": "success", "message": "Password reset successfully."}


def login_user(request, username: str, password: str):
    user = authenticate(request, username=(username or "").strip(), password=password)
    if user is None:
        return False, {"message": "Invalid username or password."}

    login(request, user)
    role = "admin" if user.is_superuser else "user"
    return True, {
        "message": "Login successful.",
        "user": {"id": user.id, "username": user.username, "role": role},
    }


def logout_user(request) -> dict:
    logout(request)
    return {"status": "success", "message": "Logout successful."}


def list_users() -> dict:
    return {
        "status": "success",
        "data": [
            {
                "id": user.id,
                "username": user.username,
                "email": user.email,
                "role": "admin" if user.is_superuser else "user",
            }
            for user in User.objects.order_by("username")
        ],
    }