from django.contrib import admin

from .models import ClientDevice, DeviceBindingAudit, DeviceSession


def _masked_fingerprint(value: str) -> str:
    if not value:
        return ""
    return f"{value[:8]}...{value[-6:]}"


@admin.register(ClientDevice)
class ClientDeviceAdmin(admin.ModelAdmin):
    list_display = (
        "user",
        "product_code",
        "platform",
        "client_version",
        "status",
        "last_seen_at",
        "first_seen_at",
    )
    list_filter = ("product_code", "platform", "status", "last_seen_at")
    search_fields = ("user__username", "user__email")
    list_select_related = ("user",)
    ordering = ("-last_seen_at", "-id")
    readonly_fields = (
        "user",
        "product_code",
        "device_id_version",
        "device_fingerprint_masked",
        "public_key_fingerprint_masked",
        "platform",
        "client_version",
        "status",
        "first_seen_at",
        "last_seen_at",
        "created_at",
        "updated_at",
    )
    fields = readonly_fields

    def has_add_permission(self, request):
        return False

    def has_delete_permission(self, request, obj=None):
        return False

    @admin.display(description="设备摘要")
    def device_fingerprint_masked(self, obj):
        return _masked_fingerprint(obj.device_fingerprint)

    @admin.display(description="安装公钥摘要")
    def public_key_fingerprint_masked(self, obj):
        return _masked_fingerprint(obj.public_key_fingerprint)


@admin.register(DeviceSession)
class DeviceSessionAdmin(admin.ModelAdmin):
    list_display = ("device", "expires_at", "last_used_at", "revoked_at", "created_at")
    list_filter = ("revoked_at", "expires_at")
    search_fields = ("device__user__username", "device__user__email")
    list_select_related = ("device", "device__user")
    readonly_fields = (
        "device",
        "expires_at",
        "last_used_at",
        "revoked_at",
        "created_at",
    )
    fields = readonly_fields

    def has_add_permission(self, request):
        return False

    def has_change_permission(self, request, obj=None):
        return False

    def has_delete_permission(self, request, obj=None):
        return False


@admin.register(DeviceBindingAudit)
class DeviceBindingAuditAdmin(admin.ModelAdmin):
    list_display = ("user", "device", "api_key", "action", "reason", "created_at")
    list_filter = ("action", "created_at")
    search_fields = ("user__username", "user__email", "api_key__key_prefix")
    list_select_related = ("user", "device", "api_key")
    readonly_fields = (
        "user",
        "device",
        "api_key",
        "action",
        "reason",
        "client_version",
        "created_at",
    )
    fields = readonly_fields

    def has_add_permission(self, request):
        return False

    def has_change_permission(self, request, obj=None):
        return False

    def has_delete_permission(self, request, obj=None):
        return False