from django.shortcuts import redirect
from django.utils.deprecation import MiddlewareMixin

from ..models import TwoFactorConfig


class TwoFactorMiddleware(MiddlewareMixin):
    """Enforces 2FA verification for users who have it configured."""

    EXEMPT_PATHS = [
        "/api/auth/login/",
        "/api/auth/logout/",
        "/api/auth/2fa/verify/",
        "/api/auth/2fa/recovery/",
        "/api/auth/check/",
    ]

    def process_request(self, request):
        if not hasattr(request, "user") or not request.user.is_authenticated:
            return None
        if request.path in self.EXEMPT_PATHS:
            return None
        if request.path.startswith("/admin/"):
            return None
        try:
            tfa = TwoFactorConfig.objects.get(user=request.user)
            if tfa.is_enabled and tfa.is_configured:
                if not getattr(request, "_2fa_verified", False):
                    return redirect("2fa-verify")
        except TwoFactorConfig.DoesNotExist:
            pass
        return None