from django.contrib import admin

from .models import AgentRun, AgentRunEvent, HumanApproval, ModelProviderConfig, ToolCall
from .services import resolve_approval


class ReadOnlyAuditAdmin(admin.ModelAdmin):
    """审计记录允许查看但禁止通过 Admin 改写或删除。"""

    def has_add_permission(self, request):
        return False

    def has_change_permission(self, request, obj=None):
        return request.user.is_staff if obj is None else False

    def has_delete_permission(self, request, obj=None):
        return False


@admin.register(AgentRun)
class AgentRunAdmin(admin.ModelAdmin):
    list_display = ("title", "owner", "status", "created_at", "finished_at")
    list_filter = ("status",)
    search_fields = ("title", "owner__username", "trace_id")


admin.site.register(AgentRunEvent, ReadOnlyAuditAdmin)
admin.site.register(ToolCall, ReadOnlyAuditAdmin)


@admin.register(ModelProviderConfig)
class ModelProviderConfigAdmin(admin.ModelAdmin):
    """只展示连接元数据，密文 API Key 不进入 Admin 页面。"""

    list_display = (
        "provider_code",
        "owner",
        "status",
        "is_default",
        "last_verified_at",
    )
    list_filter = ("status", "is_default", "enabled")
    search_fields = ("provider_code", "owner__username")
    exclude = ("encrypted_api_key",)
    readonly_fields = ("key_hint", "available_models", "last_verified_at", "last_error_code")

    def has_add_permission(self, request):
        """服务商配置必须经过页面连接验证，Admin 不允许绕过验证直接创建。"""

        return False

@admin.register(HumanApproval)
class HumanApprovalAdmin(admin.ModelAdmin):
    """人工确认正文只读，通过受控动作执行领域状态转换。"""

    list_display = ("approval_type", "run", "status", "requested_at", "resolved_by")
    list_filter = ("status", "approval_type")
    readonly_fields = tuple(field.name for field in HumanApproval._meta.fields)
    actions = ("approve_selected", "reject_selected")

    @admin.action(description="通过选中的待确认请求")
    def approve_selected(self, request, queryset):
        for approval in queryset:
            resolve_approval(request.user, approval.id, True, {"source": "admin"})

    @admin.action(description="拒绝选中的待确认请求")
    def reject_selected(self, request, queryset):
        for approval in queryset:
            resolve_approval(request.user, approval.id, False, {"source": "admin"})

    def has_add_permission(self, request):
        return False

    def has_delete_permission(self, request, obj=None):
        return False