from django.apps import AppConfig


class UsersConfig(AppConfig):
    default_auto_field = 'django.db.models.BigAutoField'
    name = 'apps.users'

    def ready(self):
        from django.db.models.signals import post_migrate

        post_migrate.connect(seed_roles_and_permissions, sender=self)


def seed_roles_and_permissions(sender, **kwargs):
    """After migrations, ensure a Group exists for every managed role, seed each
    role's default permissions, and attach existing users to their role group.
    Idempotent — safe to run on every migrate. Runs after Django has created the
    model permissions, so all permissions are resolvable here."""
    from django.contrib.auth import get_user_model
    from django.contrib.auth.models import Group, Permission

    from core.roles import (
        ADMIN,
        DEFAULT_ROLE_PERMISSIONS,
        MANAGED_ROLES,
    )

    for role in MANAGED_ROLES:
        group, _ = Group.objects.get_or_create(name=role)
        if role == ADMIN:
            group.permissions.set(Permission.objects.all())
            continue
        perms = []
        for key in DEFAULT_ROLE_PERMISSIONS.get(role, []):
            app_label, codename = key.split(".", 1)
            perm = Permission.objects.filter(
                content_type__app_label=app_label, codename=codename
            ).first()
            if perm:
                perms.append(perm)
        # Only seed when the group is empty; never clobber admin-customized perms.
        if group.permissions.count() == 0:
            group.permissions.set(perms)

    # Attach every user to the group matching their current role.
    User = get_user_model()
    for user in User.objects.all():
        try:
            user.sync_role_group()
        except Exception:
            pass