# src/django_core_micha/auth/adapters.py
from allauth.socialaccount.adapter import DefaultSocialAccountAdapter
from django.contrib.auth import get_user_model
from allauth.account.adapter import DefaultAccountAdapter
from django_core_micha.auth.security import set_security_level
from allauth.mfa.adapter import DefaultMFAAdapter
from django.conf import settings

class CoreMFAAdapter(DefaultMFAAdapter):
    def is_mfa_enabled(self, user):
        # If project wants strong by default: enforce MFA for everyone
        if getattr(settings, "SECURITY_DEFAULT_LEVEL", "basic") == "strong":
            return True

        # Else: default behaviour (MFA only if user actually configured something)
        return super().is_mfa_enabled(user)



class InvitationOnlySocialAdapter(DefaultSocialAccountAdapter):
    def is_open_for_signup(self, request, sociallogin):
        User = get_user_model()
        email = sociallogin.user.email
        # Erlaubt Login nur, wenn User schon existiert
        return User.objects.filter(email__iexact=email).exists()
    

class CoreAccountAdapter(DefaultAccountAdapter):
    """
    Core adapter that sets the auth_level after a successful login.
    """

    def login(self, request, user):
        """
        Called by allauth when logging in a user.
        """
        response = super().login(request, user)
        # For now, every normal login starts as BASIC.
        set_security_level(request, "basic")
        return response