# Generated by Django 5.1.4 on 2026-01-16 12:22

from django.db import migrations


def create_default_permissions(apps, schema_editor):
    """Create default permissions and permission groups.

    This creates:
    1. Read permissions for cases, laws, courts, and lawbooks
    2. A "default" permission group with these read-only permissions
    3. Sets the default group as is_default=True
    """
    APITokenPermission = apps.get_model("accounts", "APITokenPermission")
    APITokenPermissionGroup = apps.get_model("accounts", "APITokenPermissionGroup")

    # Define the default read permissions
    default_resources = [
        ("cases", "Cases"),
        ("laws", "Laws"),
        ("courts", "Courts"),
        ("lawbooks", "Law Books"),
    ]

    # Create read permissions for default resources
    read_permissions = []
    for resource, resource_display in default_resources:
        permission, created = APITokenPermission.objects.get_or_create(
            resource=resource,
            action="read",
            defaults={"description": f"Allows read-only access to {resource_display}"},
        )
        read_permissions.append(permission)

    # Create the default permission group
    default_group, created = APITokenPermissionGroup.objects.get_or_create(
        name="default",
        defaults={
            "description": (
                "Default permission group for new API tokens. "
                "Provides read-only access to cases, laws, courts, and law books."
            ),
            "is_default": True,
        },
    )

    # Add permissions to the default group
    if created:
        default_group.permissions.set(read_permissions)

    # Create additional common permissions for admins to use
    write_resources = [
        ("cases", "Cases"),
        ("laws", "Laws"),
        ("courts", "Courts"),
        ("lawbooks", "Law Books"),
        ("references", "References"),
        ("annotations", "Annotations"),
    ]

    for resource, resource_display in write_resources:
        # Create write permission
        APITokenPermission.objects.get_or_create(
            resource=resource,
            action="write",
            defaults={
                "description": f"Allows creating and updating {resource_display}"
            },
        )
        # Create delete permission
        APITokenPermission.objects.get_or_create(
            resource=resource,
            action="delete",
            defaults={"description": f"Allows deleting {resource_display}"},
        )


def reverse_default_permissions(apps, schema_editor):
    """Reverse the migration by deleting created permissions and groups"""
    APITokenPermission = apps.get_model("accounts", "APITokenPermission")
    APITokenPermissionGroup = apps.get_model("accounts", "APITokenPermissionGroup")

    # Delete the default group
    APITokenPermissionGroup.objects.filter(name="default").delete()

    # Delete all permissions (they will be recreated on next forward migration)
    APITokenPermission.objects.all().delete()


class Migration(migrations.Migration):
    dependencies = [
        ("accounts", "0002_apitokenpermission_apitokenpermissiongroup_and_more"),
    ]

    operations = [
        migrations.RunPython(create_default_permissions, reverse_default_permissions),
    ]
