from __future__ import annotations

from sqlalchemy.orm import Session

from govoplan_core.admin.common import AdminConflictError
from govoplan_access.backend.db.models import (
    ApiKey,
    Group,
    Role,
    Tenant,
)
from govoplan_core.tenancy.service import effective_tenant_governance


def ensure_group_mutation_allowed(group: Group, *, requested_active: bool | None = None) -> None:
    if group.system_template_id and group.system_required and requested_active is False:
        raise AdminConflictError("This centrally required group cannot be deactivated by the tenant.")


def ensure_role_mutation_allowed(role: Role, *, requested_assignable: bool | None = None) -> None:
    if role.system_template_id:
        if role.system_required and requested_assignable is False:
            raise AdminConflictError("This centrally required role cannot be made unavailable by the tenant.")
        raise AdminConflictError("Centrally managed role definitions can only be changed in System administration.")


def assert_api_keys_allowed(session: Session, tenant: Tenant) -> None:
    if not effective_tenant_governance(session, tenant).allow_api_keys:
        raise AdminConflictError("API-key creation is disabled by system or tenant governance.")


def assert_custom_groups_allowed(session: Session, tenant: Tenant) -> None:
    if not effective_tenant_governance(session, tenant).allow_custom_groups:
        raise AdminConflictError("Custom tenant groups are disabled by system or tenant governance.")


def assert_custom_roles_allowed(session: Session, tenant: Tenant) -> None:
    if not effective_tenant_governance(session, tenant).allow_custom_roles:
        raise AdminConflictError("Custom tenant roles are disabled by system or tenant governance.")


def active_api_key_count(session: Session, tenant_id: str) -> int:
    return session.query(ApiKey).filter(ApiKey.tenant_id == tenant_id, ApiKey.revoked_at.is_(None)).count()