import unicodedata
import uuid
from typing import List
from django.contrib.auth import password_validation
from django.contrib.auth.base_user import BaseUserManager
from django.contrib.auth.hashers import (
    check_password,
    is_password_usable,
    make_password,
)
from django.contrib.auth.validators import UnicodeUsernameValidator
from django.core.mail import send_mail
from django.utils import timezone
from django.contrib.auth.models import Permission, Group
from django.db import models
from django.utils.crypto import salted_hmac
from django.utils.translation import gettext_lazy as _
from django.apps import apps
from django.db import transaction
from .services.user_repository import create_user_by_owner
from django.contrib.auth import get_user_model


class UserManager(BaseUserManager):
    use_in_migrations = True

    def _create_user(self, username, email, password, **extra_fields):
        """
        Create and save a user with the given username, email, and password.
        """
        if not username:
            raise ValueError("The given username must be set")
        with transaction.atomic():
            email = self.normalize_email(email)
            # Lookup the real model class from the global app registry so this
            # manager method can be used in migrations. This is fine because
            # managers are by definition working on the real model.
            GlobalUserModel = apps.get_model(
                self.model._meta.app_label, self.model._meta.object_name
            )
            username = GlobalUserModel.normalize_username(username)
            user = self.model(username=username, email=email, **extra_fields)
            user.password = make_password(password)
            user.save(using=self._db)
            user_id = create_user_by_owner(user, password=password)
            get_user_model().objects.filter(id=user.id).update(id=user_id)
            user.id = user_id
            return user


    def create_user(self, username, email=None, password=None, **extra_fields):
        extra_fields.setdefault("is_staff", False)
        extra_fields.setdefault("is_superuser", False)
        return self._create_user(username, email, password, **extra_fields)

    def create_superuser(self, username, email=None, password=None, **extra_fields):
        extra_fields.setdefault("is_staff", True)
        extra_fields.setdefault("is_superuser", True)
        extra_fields.setdefault("email_verified", True)

        if extra_fields.get("is_staff") is not True:
            raise ValueError("Superuser must have is_staff=True.")
        if extra_fields.get("is_superuser") is not True:
            raise ValueError("Superuser must have is_superuser=True.")
        if extra_fields.get("email_verified") is not True:
            raise ValueError("Superuser must have email_verified=True.")

        return self._create_user(username, email, password, **extra_fields)

    def with_perm(
        self, perm, is_active=True, include_superusers=True, backend=None, obj=None
    ):
        return self.none()


class keycloakUserAbstract(models.Model):
    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
    password = models.CharField(_("password"), max_length=128)
    # Stores the raw password if set_password() is called so that it can
    # be passed to password_changed() after the model is saved.
    _password = None
    last_login = models.DateTimeField(_("last login"), blank=True, null=True)
    email_verified = models.BooleanField(
        _("email status"),
        default=False
    )

    """
        An abstract base class implementing a fully featured User model with
        admin-compliant permissions.

        Username and password are required. Other fields are optional.
        """

    username_validator = UnicodeUsernameValidator()

    username = models.CharField(
        _("username"),
        max_length=150,
        unique=True,
        help_text=_(
            "Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only."
        ),
        validators=[username_validator],
        error_messages={
            "unique": _("A user with that username already exists."),
        },
    )
    first_name = models.CharField(_("first name"), max_length=150, blank=True)
    last_name = models.CharField(_("last name"), max_length=150, blank=True)
    email = models.EmailField(_("email address"), blank=True, unique=True)
    is_staff = models.BooleanField(
        _("staff status"),
        default=False,
        help_text=_("Designates whether the user can log into this admin site."),
    )
    is_active = models.BooleanField(
        _("active"),
        default=True,
        help_text=_(
            "Designates whether this user should be treated as active. "
            "Unselect this instead of deleting accounts."
        ),
    )
    date_joined = models.DateTimeField(_("date joined"), default=timezone.now)

    objects = UserManager()

    EMAIL_FIELD = "email"
    USERNAME_FIELD = 'email'
    REQUIRED_FIELDS = ['username', 'first_name', 'last_name']

    """
         Add the fields and methods necessary to support the Group and Permission
         models using the ModelBackend.
         """

    is_superuser = models.BooleanField(
        _("superuser status"),
        default=False,
        help_text=_(
            "Designates that this user has all permissions without "
            "explicitly assigning them."
        ),
    )
    permissions: List[Permission] = []
    groups: List[Group] = []

    class Meta:
        verbose_name = _("user")
        verbose_name_plural = _("users")
        abstract = True

    def get_username(self):
        """Return the username for this User."""
        return getattr(self, self.USERNAME_FIELD)

    def clean(self):
        setattr(self, self.USERNAME_FIELD, self.normalize_username(self.get_username()))
        self.email = self.__class__.objects.normalize_email(self.email)


    def natural_key(self):
        return self.get_username(),


    @property
    def is_anonymous(self):
        """
        Always return False. This is a way of comparing User objects to
        anonymous users.
        """
        return False

    @property
    def is_authenticated(self):
        """
        Always return True. This is a way to tell if the user has been
        authenticated in templates.
        """
        return True

    def set_password(self, raw_password):
        self.password = make_password(raw_password)
        self._password = raw_password

    def check_password(self, raw_password):
        """
        Return a boolean of whether the raw_password was correct. Handles
        hashing formats behind the scenes.
        """

        def setter(raw_password):
            self.set_password(raw_password)
            # Password hash upgrades shouldn't be considered password changes.
            self._password = None
            self.save(update_fields=["password"])

        return check_password(raw_password, self.password, setter)

    def set_unusable_password(self):
        # Set a value that will never be a valid hash
        self.password = make_password(None)

    def has_usable_password(self):
        """
        Return False if set_unusable_password() has been called for this user.
        """
        return is_password_usable(self.password)

    def get_session_auth_hash(self):
        """
        Return an HMAC of the password field.
        """
        key_salt = "django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash"
        return salted_hmac(
            key_salt,
            self.password,
            algorithm="sha256",
        ).hexdigest()

    @classmethod
    def get_email_field_name(cls):
        try:
            return cls.EMAIL_FIELD
        except AttributeError:
            return "email"

    @classmethod
    def normalize_username(cls, username):
        return (
            unicodedata.normalize("NFKC", username)
            if isinstance(username, str)
            else username
        )

    def get_full_name(self):
        """
        Return the first_name plus the last_name, with a space in between.
        """
        full_name = "%s %s" % (self.first_name, self.last_name)
        return full_name.strip()

    def get_short_name(self):
        """Return the short name for the user."""
        return self.first_name

    def email_user(self, subject, message, from_email=None, **kwargs):
        """Send an email to this user."""
        send_mail(subject, message, from_email, [self.email], **kwargs)

    def save(self, *args, **kwargs):
        super().save(*args, **kwargs)
        if self._password is not None:
            password_validation.password_changed(self._password, self)
            self._password = None


    def get_user_permissions(self, obj=None):
        """
        Return a list of permission strings that this user has directly.
        Query all available auth_panel backends. If an object is passed in,
        return only permissions matching this object.
        """
        return set(self.permissions)

    def get_group_permissions(self, obj=None):
        """
        Return a list of permission strings that this user has through their
        groups. Query all available auth_panel backends. If an object is passed in,
        return only permissions matching this object.
        """
        return set(self.permissions)

    def get_all_permissions(self, obj=None):
        return set([perm.name for perm in self.permissions])

    def has_perm(self, perm, obj=None):
        """
        Return True if the user has the specified permission. Query all
        available auth_panel backends, but return immediately if any backend returns
        True. Thus, a user who has permission from a single auth_panel backend is
        assumed to have permission in general. If an object is provided, check
        permissions for that object.
        """

        if self.is_active and self.is_superuser:
            return True

        # Otherwise we need to check the backends.
        return perm in self.get_all_permissions()

    def has_perms(self, perm_list, obj=None):
        """
        Return True if the user has each of the specified permissions. If
        object is passed, check if the user has all required perms for it.
        """
        if self.is_active and self.is_superuser:
            return True

        return all(self.has_perm(perm, obj) for perm in perm_list)

    def has_module_perms(self, app_label):
        """
        Return True if the user has any permissions in the given app label.
        Use similar logic as has_perm(), above.
        """
        if self.is_active and self.is_superuser:
            return True

        # Active superusers have all permissions.
        return self.is_active and any(
            perm[:perm.index('.')] == app_label
            for perm in self.get_all_permissions()
        )

    def __str__(self) -> str:
        return str(self.id)


class User(keycloakUserAbstract):
    first_name = models.CharField(_('first name'), max_length=150, blank=True)
    last_name = models.CharField(_('last name'), max_length=150, blank=True)

    class Meta:
        managed = False
        db_table = 'user_keycload'
        verbose_name = 'User'
        verbose_name_plural = 'Users'


class Realm(models.Model):
    url = models.CharField(max_length=255, null=False, blank=False,
                            help_text='Url as known on the Keycloak server. '
                                      'This url is used in the API paths '
                                      'of this Realm.')
    name = models.CharField(max_length=255, unique=True, null=False, blank=False,
                            help_text='Name as known on the Keycloak server. '
                                      'This name is used in the API paths '
                                      'of this Realm.')
    client_id = models.CharField(max_length=255, null=False, blank=False,
                                 help_text='Client id as known on the Keycloak server. '
                                      'This name is used in the API paths '
                                      'of this Realm.')
    secret = models.CharField(max_length=255, null=False, blank=False,
                              help_text='Secret of client id on the Keycloak server.')
    username_or_email = models.CharField(max_length=255, null=False, blank=False,
                              help_text='User of client id on the Keycloak server.')
    password = models.CharField(max_length=255, null=False, blank=False,
                              help_text='Password of user on the Keycloak server.')

    def __str__(self):
        return self.name


    class Meta:
        managed = True
        db_table = 'realm'
        verbose_name = 'Realm'
        verbose_name_plural = 'Realms'

        
class Client(models.Model):
    realm = models.ForeignKey(Realm, related_name='client',
                                 on_delete=models.CASCADE)
    client_id = models.CharField(max_length=255)
    

    def __str__(self):
        return self.client_id

    class Meta:
        managed = True
        db_table = 'realm_client'
        verbose_name = 'Realm Client'
        verbose_name_plural = 'Realm Clients'

