import jwt
from datetime import datetime, timedelta, timezone
from django.conf import settings
from ninja.security import HttpBearer
from django.contrib.auth import get_user_model

User = get_user_model()

def create_access_token(user_id: str, organization_id: str = None) -> str:
    """Create a short-lived JWT access token."""
    expire = datetime.now(timezone.utc) + timedelta(minutes=settings.JWT_ACCESS_TOKEN_LIFETIME_MINUTES)
    payload = {
        'sub': str(user_id),
        'org_id': str(organization_id) if organization_id else None,
        'exp': expire,
        'iat': datetime.now(timezone.utc),
        'type': 'access'
    }
    return jwt.encode(payload, settings.JWT_SECRET_KEY, algorithm=settings.JWT_ALGORITHM)

def create_refresh_token(user_id: str) -> str:
    """Create a long-lived JWT refresh token."""
    expire = datetime.now(timezone.utc) + timedelta(days=settings.JWT_REFRESH_TOKEN_LIFETIME_DAYS)
    payload = {
        'sub': str(user_id),
        'exp': expire,
        'iat': datetime.now(timezone.utc),
        'type': 'refresh'
    }
    return jwt.encode(payload, settings.JWT_SECRET_KEY, algorithm=settings.JWT_ALGORITHM)

def decode_token(token: str) -> dict:
    """Decode and validate a JWT token."""
    try:
        payload = jwt.decode(token, settings.JWT_SECRET_KEY, algorithms=[settings.JWT_ALGORITHM])
        return payload
    except jwt.ExpiredSignatureError:
        return None
    except jwt.InvalidTokenError:
        return None

class JWTAuth(HttpBearer):
    """Django Ninja Bearer token authentication."""
    def authenticate(self, request, token):
        payload = decode_token(token)
        if not payload or payload.get('type') != 'access':
            return None
        
        user_id = payload.get('sub')
        try:
            user = User.objects.get(id=user_id, is_active=True)
            request.user = user
            request.tenant_id = payload.get('org_id')
            return user
        except User.DoesNotExist:
            return None