import json
from pathlib import Path

from django.contrib.auth import logout
from django.shortcuts import redirect
from django.utils import timezone

SESSION_LAST_ACTIVITY = "skv_last_activity"
DEFAULT_TIMEOUT_MINUTES = 15


def get_session_timeout_seconds():
    """Read the saved timeout; safely fall back to 15 minutes."""
    config_path = Path(__file__).resolve().parent.parent / "session_timeout.json"

    try:
        with config_path.open("r", encoding="utf-8") as config_file:
            config = json.load(config_file)

        minutes = int(config.get("minutes", DEFAULT_TIMEOUT_MINUTES))

        # Prevent accidental or unsafe timeout values.
        if not 1 <= minutes <= 480:
            return DEFAULT_TIMEOUT_MINUTES * 60

        return minutes * 60

    except (OSError, ValueError, TypeError, json.JSONDecodeError):
        return DEFAULT_TIMEOUT_MINUTES * 60


class SessionSecurityMiddleware:
    """Expire inactive staff sessions without deleting business records."""

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        if (
            request.user.is_authenticated
            and request.user.is_staff
        ):
            now = timezone.now().timestamp()
            previous = request.session.get(SESSION_LAST_ACTIVITY)

            if previous is not None:
                try:
                    elapsed = now - float(previous)
                except (TypeError, ValueError):
                    elapsed = 0

                if elapsed >= get_session_timeout_seconds():
                    logout(request)
                    request.session.flush()
                    return redirect("/login/?timeout=1")

            request.session[SESSION_LAST_ACTIVITY] = now
            request.session.modified = True

        return self.get_response(request)