# -*- coding: UTF-8 -*

"""Users and Roles models for ScoDoc
"""

import base64
from datetime import datetime, timedelta
import os
import re
from time import time
from typing import Optional

import cracklib  # pylint: disable=import-error

from flask import current_app, flash, g
from flask_login import UserMixin, AnonymousUserMixin
from sqlalchemy.exc import (
    IntegrityError,
    DataError,
    DatabaseError,
    OperationalError,
    ProgrammingError,
    StatementError,
    InterfaceError,
)

from werkzeug.security import generate_password_hash, check_password_hash

import jwt

from app import db, email, log, login
from app.models import Departement, ScoDocModel
from app.models import SHORT_STR_LEN, USERNAME_STR_LEN
from app.models.config import ScoDocSiteConfig
from app.scodoc.sco_exceptions import ScoValueError
from app.scodoc.sco_permissions import Permission
from app.scodoc.sco_roles_default import SCO_ROLES_DEFAULTS
import app.scodoc.sco_utils as scu

VALID_LOGIN_EXP = re.compile(r"^[a-zA-Z0-9@\\\-_\.]+$")
DEFAULT_RESET_TOKEN_DURATION = 24 * 60 * 60  # seconds (default 24h)


def is_valid_password(cleartxt) -> bool:
    """Check password.
    returns True if OK.
    """
    if (
        hasattr(scu.CONFIG, "MIN_PASSWORD_LENGTH")
        and scu.CONFIG.MIN_PASSWORD_LENGTH > 0
        and len(cleartxt) < scu.CONFIG.MIN_PASSWORD_LENGTH
    ):
        return False  # invalid: too short
    try:
        _ = cracklib.FascistCheck(cleartxt)
        return True
    except ValueError:
        return False


def is_valid_user_name(user_name: str) -> bool:
    "Check that user_name (aka login) is valid"
    return (
        user_name
        and (len(user_name) >= 2)
        and (len(user_name) < USERNAME_STR_LEN)
        and VALID_LOGIN_EXP.match(user_name)
    )


class User(UserMixin, ScoDocModel):
    """ScoDoc users, handled by Flask / SQLAlchemy"""

    id = db.Column(db.Integer, primary_key=True)
    user_name = db.Column(db.String(USERNAME_STR_LEN), index=True, unique=True)
    "le login"
    email = db.Column(db.String(120))
    "email à utiliser par ScoDoc"
    email_institutionnel = db.Column(db.String(120))
    "email dans l'établissement, facultatif"
    nom = db.Column(db.String(USERNAME_STR_LEN))
    prenom = db.Column(db.String(USERNAME_STR_LEN))
    dept = db.Column(db.String(SHORT_STR_LEN), index=True)
    "acronyme du département de l'utilisateur"
    active = db.Column(db.Boolean, default=True, index=True)
    "si faux, compte utilisateur désactivé"
    cas_id = db.Column(db.Text(), index=True, unique=True, nullable=True)
    "uid sur le CAS (id, mail ou autre attribut, selon config.cas_attribute_id)"
    cas_allow_login = db.Column(
        db.Boolean, default=False, server_default="false", nullable=False
    )
    "Peut-on se logguer via le CAS ?"
    cas_allow_scodoc_login = db.Column(
        db.Boolean, default=False, server_default="false", nullable=False
    )
    """Si CAS activé et forcé, peut-on se logguer sur ScoDoc directement ?
    (le rôle ScoSuperAdmin peut toujours, mettre à True pour les utilisateur API)
    """
    cas_last_login = db.Column(db.DateTime, nullable=True)
    """date du dernier login via CAS"""
    edt_id = db.Column(db.Text(), index=True, nullable=True)
    "identifiant emplois du temps (unicité non imposée)"
    password_hash = db.Column(db.Text())  # les hashs modernes peuvent être très longs
    password_scodoc7 = db.Column(db.String(42))
    last_seen = db.Column(db.DateTime, default=datetime.now)
    date_modif_passwd = db.Column(db.DateTime, default=datetime.now)
    date_created = db.Column(db.DateTime, default=datetime.now)
    date_expiration = db.Column(db.DateTime, default=None)
    passwd_must_be_changed = db.Column(
        db.Boolean, nullable=False, server_default="false", default=False
    )
    passwd_temp = db.Column(db.Boolean, default=False)
    """champ obsolete. Si connexion alors que passwd_temp est vrai,
    efface mot de passe et redirige vers accueil."""
    token = db.Column(db.Text(), index=True, unique=True)
    token_expiration = db.Column(db.DateTime)

    # Define the back reference from User to ModuleImpl
    modimpls = db.relationship("ModuleImpl", back_populates="responsable")
    roles = db.relationship("Role", secondary="user_role", viewonly=True)
    Permission = Permission

    _departement = db.relationship(
        "Departement",
        foreign_keys=[Departement.acronym],
        primaryjoin=(dept == Departement.acronym),
        lazy="select",
        passive_deletes="all",
        uselist=False,
    )

    def __init__(self, **kwargs):
        "user_name:str is mandatory"
        self.roles = []
        self.user_roles = []
        # check login:
        if "user_name" not in kwargs:
            raise ValueError("missing user_name argument")
        if not is_valid_user_name(kwargs["user_name"]):
            raise ValueError(f"invalid user_name: {kwargs['user_name']}")
        kwargs["nom"] = kwargs.get("nom", "") or ""
        kwargs["prenom"] = kwargs.get("prenom", "") or ""
        super().__init__(**kwargs)
        # Ajoute roles:
        if (
            not self.roles
            and self.email
            and self.email == current_app.config["SCODOC_ADMIN_MAIL"]
        ):
            # super-admin
            admin_role = Role.query.filter_by(name="SuperAdmin").first()
            assert admin_role
            self.add_role(admin_role, None)
            db.session.commit()
        # current_app.logger.info("creating user with roles={}".format(self.roles))

    def __repr__(self):
        return f"""<User {self.user_name} id={self.id} dept={self.dept}{
            ' (inactive)' if not self.active else ''}>"""

    def __str__(self):
        return self.user_name

    @classmethod
    def get_user(cls, user_id: int | str, accept_none=False):
        """Get user by id, user_name or User instance, ou 404 (ou None si accept_none)
        If user_id == -1, returns None (without exception)
        """
        query = None
        if isinstance(user_id, str):
            query = db.session.query(cls).filter_by(user_name=user_id)
        elif isinstance(user_id, int):
            if user_id == -1:
                return None
            query = db.session.query(cls).filter_by(id=user_id)
        elif isinstance(user_id, User):
            return user_id
        else:
            raise ValueError("invalid user_id")
        return query.first_or_404() if not accept_none else query.first()

    def can_login_using_cas(self, require_cas_id=False) -> bool:
        """True si l'utilisateur peut se connecter via CAS.
        Attention: si le cas_id est extrait de l'adresse mail, il est au départ vide.
        L'argument require_cas_id indique si on le requiert ou pas.
        """
        return (
            self.cas_allow_login
            and (self.cas_id or not require_cas_id)
            and ScoDocSiteConfig.is_cas_enabled()
        )

    def can_login_using_scodoc(self) -> bool:
        """True si l'utilisateur peut (essayer de) se connecter avec son compte local ScoDoc
        (si par ailleurs un mot de passe valide existe et que le compte est actif)

        Toujours vrai pour le super-admin ou si CAS non activé.
        Si CAS forcé, il faut cas_allow_scodoc_login.
        """
        if self.is_administrator():
            return True  # super admin ou autorisation individuelle

        if not ScoDocSiteConfig.is_cas_enabled():
            return True  # CAS not enabled

        return self.cas_allow_scodoc_login or not ScoDocSiteConfig.is_cas_forced()

    def set_password(self, password: str):
        "Set password"
        log(f"set_password({self})")
        previous_hash = self.password_hash
        if password:
            self.password_hash = generate_password_hash(password)
        else:
            self.password_hash = None
        if self.password_hash != previous_hash:
            self.date_modif_passwd = datetime.now()
        # La création d'un mot de passe efface l'éventuel mot de passe historique
        self.password_scodoc7 = None
        self.passwd_temp = False
        # Retire le flag
        self.passwd_must_be_changed = False

    def check_password(self, password: str) -> bool:
        """Check given password vs current one.
        Returns `True` if the password matched, `False` otherwise.
        Also checks for temporary passwords and if CAS disables scodoc login.
        """
        if not self.active:  # inactived users can't login
            current_app.logger.warning(
                f"auth: login attempt from inactive account {self}"
            )
            return False
        if self.passwd_temp:
            # Anciens comptes ScoDoc 7 non migrés
            # désactive le compte par sécurité.
            current_app.logger.warning(f"auth: desactivating legacy account {self}")
            self.active = False
            self.passwd_temp = True
            db.session.add(self)
            db.session.commit()
            send_notif_desactivation_user(self)
            return False

        if not self.can_login_using_scodoc():
            return False

        if not self.password_hash:  # user without password can't login
            if self.password_scodoc7:
                # Special case: user freshly migrated from ScoDoc7
                return self._migrate_scodoc7_password(password)
            return False

        return check_password_hash(self.password_hash, password)

    def _migrate_scodoc7_password(self, password) -> bool:
        """After migration, rehash password."""
        if scu.check_scodoc7_password(self.password_scodoc7, password):
            current_app.logger.warning(
                f"auth: migrating legacy ScoDoc7 password for {self}"
            )
            self.set_password(password)
            self.password_scodoc7 = None
            db.session.add(self)
            db.session.commit()
            return True
        return False

    def get_reset_password_token(
        self, expires_in=DEFAULT_RESET_TOKEN_DURATION
    ) -> str | None:
        """Un token pour réinitialiser son mot de passe.
        Par défaut valide durant 24 heures.
        Note: si le CAS est obligatoire pour l'utilisateur, renvoie None
        """
        # si la config CAS interdit le login ScoDoc, pas de token
        if not self.can_login_using_scodoc():
            return None
        token = jwt.encode(
            {"reset_password": self.id, "exp": time() + expires_in},
            current_app.config["SECRET_KEY"],
            algorithm="HS256",
        )
        return token

    @staticmethod
    def verify_reset_password_token(token):
        "Vérification du token de ré-initialisation du mot de passe"
        try:
            token = jwt.decode(
                token, current_app.config["SECRET_KEY"], algorithms=["HS256"]
            )
        except jwt.exceptions.ExpiredSignatureError:
            log("verify_reset_password_token: token expired")
            return None
        except Exception as exc:  # pylint: disable=bare-except
            log("verify_reset_password_token: checking token '{token}'")
            log(f"verify_reset_password_token: {exc}")
            return None
        try:
            user_id = token["reset_password"]
            # double check en principe inutile car déjà fait dans decode()
            expire = float(token["exp"])
            if time() > expire:
                log(f"verify_reset_password_token: token expired for uid={user_id}")
                return None
        except (TypeError, KeyError):
            return None
        return db.session.get(User, user_id)

    def sort_key(self) -> tuple:
        "sort key"
        return (
            (self.nom or "").upper(),
            (self.prenom or "").upper(),
            (self.user_name or "").upper(),
        )

    def to_dict(self, include_email=True):
        """l'utilisateur comme un dict, avec des champs supplémentaires"""
        data = {
            "date_expiration": (
                self.date_expiration.isoformat() + "Z" if self.date_expiration else None
            ),
            "date_modif_passwd": (
                self.date_modif_passwd.isoformat() + "Z"
                if self.date_modif_passwd
                else None
            ),
            "passwd_must_be_changed": self.passwd_must_be_changed,
            "date_created": (
                self.date_created.isoformat() + "Z" if self.date_created else None
            ),
            "dept": self.dept,
            "id": self.id,
            "active": self.active,
            "cas_id": self.cas_id,
            "cas_allow_login": self.cas_allow_login,
            "cas_allow_scodoc_login": self.cas_allow_scodoc_login,
            "cas_last_login": (
                self.cas_last_login.isoformat() + "Z" if self.cas_last_login else None
            ),
            "edt_id": self.edt_id,
            "status_txt": "actif" if self.active else "fermé",
            "last_seen": self.last_seen.isoformat() + "Z" if self.last_seen else None,
            "nom": self.nom or "",
            "prenom": self.prenom or "",
            "roles_string": self.get_roles_string(),  # eg "Ens_RT, Ens_Info"
            "user_name": self.user_name,
            # Les champs calculés:
            "nom_fmt": self.get_nom_fmt(),
            "prenom_fmt": self.get_prenom_fmt(),
            "nomprenom": self.get_nomprenom(),
            "prenomnom": self.get_prenomnom(),
            "nomplogin": self.get_nomplogin(),
            "nomcomplet": self.get_nomcomplet(),
        }
        if include_email:
            data["email"] = self.email or ""
            data["email_institutionnel"] = self.email_institutionnel or ""
        return data

    @classmethod
    def convert_dict_fields(cls, args: dict) -> dict:
        """Convert fields in the given dict. No other side effect.
        args: dict with args in application.
        returns: dict to store in model's db.
        Convert boolean values to bools.
        """
        args_dict = args
        # Dates
        if "date_expiration" in args:
            date_expiration = args.get("date_expiration")
            if isinstance(date_expiration, str):
                args["date_expiration"] = (
                    datetime.fromisoformat(date_expiration) if date_expiration else None
                )
        # booléens:
        for field in ("active", "cas_allow_login", "cas_allow_scodoc_login"):
            if field in args:
                args_dict[field] = scu.to_bool(args.get(field))

        # chaines ne devant pas être NULLs
        for field in ("nom", "prenom"):
            if field in args:
                args[field] = args[field] or ""

        # chaines ne devant pas être vides mais au contraire null (unicité)
        if "cas_id" in args:
            args["cas_id"] = args["cas_id"] or None

        return args_dict

    def from_dict(self, args: dict, new_user=False):
        """Set users' attributes from given dict values.
        - roles_string : roles, encoded like "Ens_RT, Secr_CJ"
        - date_expiration is a dateime object.
        Does not check permissions here.
        """
        if new_user:
            if "user_name" in args:
                # never change name of existing users
                # (see change_user_name method to do that)
                if not is_valid_user_name(args["user_name"]):
                    raise ValueError(f"invalid user_name: {args['user_name']}")
                self.user_name = args["user_name"]
            if "password" in args:
                self.set_password(args["password"])

        # Roles: roles_string is "Ens_RT, Secr_RT, ..."
        if "roles_string" in args:
            self.user_roles = []
            for r_d in args["roles_string"].split(","):
                if r_d:
                    role, dept = UserRole.role_dept_from_string(r_d)
                    self.add_role(role, dept)

        # email_institutionnel may not be unique, but check and warns user
        email_institutionnel = args.get("email_institutionnel")
        if email_institutionnel and email_institutionnel != self.email_institutionnel:
            nb_with_this_mail = (
                db.session.query(User)
                .filter_by(email_institutionnel=email_institutionnel)
                .count()
            )
            if nb_with_this_mail > 0:
                log(
                    "User.from_dict: plusieurs utilisateurs avec ce mail institutionnel"
                )
                flash(
                    "Attention: plusieurs utilisateurs avec ce mail institutionnel",
                    "warning",
                )

        super().from_dict(
            args, excluded={"cas_id", "user_name", "roles_string", "roles"}
        )

        new_cas_id = args.get("cas_id", "").strip() or None
        if ScoDocSiteConfig.cas_uid_use_scodoc():
            new_cas_id = self.user_name
        else:
            # Set cas_id using regexp if configured:
            exp = ScoDocSiteConfig.get("cas_uid_from_mail_regexp")
            if exp and self.email_institutionnel:
                cas_id = ScoDocSiteConfig.extract_cas_id(self.email_institutionnel)
                if cas_id:
                    new_cas_id = cas_id
        if new_cas_id != self.cas_id:
            existing: User = (
                db.session.query(User).filter_by(cas_id=new_cas_id).first()
                if new_cas_id is not None
                else None
            )
            if not existing:
                self.cas_id = new_cas_id
            else:
                msg = f"""CAS id invalide pour {self.user_name
                    }, déjà utilisé par {existing.user_name}"""
                log(f"User.from_dict: {msg}")
                raise ScoValueError(msg)

    def get_token(self, expires_in=3600):
        "Un jeton pour cet user. Stocké en base, non commité."
        now = datetime.now()
        if self.token and self.token_expiration > now + timedelta(seconds=60):
            return self.token
        self.token = base64.b64encode(os.urandom(24)).decode("utf-8")
        self.token_expiration = now + timedelta(seconds=expires_in)
        db.session.add(self)
        return self.token

    def revoke_token(self):
        "Révoque le jeton de cet utilisateur"
        self.token_expiration = datetime.now() - timedelta(seconds=1)

    @staticmethod
    def check_token(token):
        """Retreive user for given token, check token's validity
        and returns the user object.
        """
        user = User.query.filter_by(token=token).first()
        if user is None or user.token_expiration < datetime.now():
            return None
        return user

    def get_dept_id(self) -> int:
        "returns user's department id, or None"
        if self.dept:
            return self._departement.id
        return None

    def get_emails(self):
        "List mail adresses to contact this user"
        mails = []
        if self.email:
            mails.append(self.email)
        if self.email_institutionnel:
            mails.append(self.email_institutionnel)
        return mails

    # Permissions management:
    def has_permission(self, perm: int, dept: str = False):
        """Check if user has permission `perm` in given `dept` (acronym).
        Similar to Zope ScoDoc7 `has_permission``

        Args:
            perm: integer, one of the value defined in Permission class.
            dept: dept id (eg 'RT'), default to current departement.
        """
        if not self.active:
            return False
        if dept is False:
            dept = g.scodoc_dept
        # les role liés à ce département, et les roles avec dept=None (super-admin)
        roles_in_dept = (
            UserRole.query.filter_by(user_id=self.id)
            .filter(
                (UserRole.dept == dept)
                | (UserRole.dept == None)  # pylint: disable=C0121
            )
            .all()
        )
        for user_role in roles_in_dept:
            if user_role.role.has_permission(perm):
                return True
        return False

    # Role management
    def add_role(self, role: "Role", dept: str):
        """Add a role to this user.
        :param role: Role to add.
        """
        if not isinstance(role, Role):
            raise ScoValueError("add_role: rôle invalide")
        user_role = UserRole(user=self, role=role, dept=dept)
        db.session.add(user_role)
        self.user_roles.append(user_role)

    def add_roles(self, roles: "list[Role]", dept: str):
        """Add roles to this user.
        :param roles: Roles to add.
        """
        for role in roles:
            self.add_role(role, dept)

    def set_roles(self, roles, dept):
        "set roles in the given dept"
        self.user_roles = []
        for r in roles:
            if isinstance(r, Role):
                self.add_role(r, dept)

    def get_roles(self):
        "iterator on my roles"
        for role in self.roles:
            yield role

    def get_roles_string(self):
        """string repr. of user's roles (with depts)
        e.g. "Ens_RT, Ens_Info, Secr_CJ"
        """
        return ", ".join(
            f"{r.role.name or ''}_{r.dept or ''}"
            for r in self.user_roles
            if r is not None
        )

    def get_depts_with_permission(self, permission: int) -> list[str]:
        """Liste des acronymes de département dans lesquels cet utilisateur
        possède la permission indiquée.
        L'"acronyme" None signifie "tous les départements".
        Si plusieurs permissions (plusieurs bits) sont indiquées, c'est un "ou":
        les départements dans lesquels l'utilisateur a l'une des permissions.
        """
        return [
            user_role.dept
            for user_role in UserRole.query.filter_by(user=self)
            .join(Role)
            .filter(Role.permissions.op("&")(permission) != 0)
        ]

    def is_administrator(self):
        "True if i'm an active SuperAdmin"
        return self.active and self.has_permission(Permission.ScoSuperAdmin, dept=None)

    # Some useful strings:
    def get_nomplogin(self):
        """nomplogin est le nom en majuscules suivi du prénom et du login
        e.g. Dupont Pierre (dupont)
        """
        nom = scu.format_nom(self.nom) if self.nom else self.user_name.upper()
        return f"{nom} {scu.format_prenom(self.prenom)} ({self.user_name})"

    @staticmethod
    def get_user_from_nomplogin(nomplogin: str) -> Optional["User"]:
        """Returns User instance from the string "Dupont Pierre (dupont)"
        or None if user does not exist
        """
        match = re.match(r".*\((.*)\)", nomplogin.strip())
        if match:
            user_name = match.group(1)
            u = User.query.filter_by(user_name=user_name).first()
            if u:
                return u
        return None

    def get_nom_fmt(self):
        """Nom formaté: "Martin" """
        if self.nom:
            return scu.format_nom(self.nom, uppercase=False)
        else:
            return self.user_name

    def get_prenom_fmt(self):
        """Prénom formaté (minuscule capitalisées)"""
        return scu.format_prenom(self.prenom)

    def get_nomprenom(self):
        """Nom capitalisé suivi de l'initiale du prénom:
        Viennet E.
        """
        prenom_abbrv = scu.abbrev_prenom(scu.format_prenom(self.prenom))
        return (self.get_nom_fmt() + " " + prenom_abbrv).strip()

    def get_prenomnom(self):
        """L'initiale du prénom suivie du nom: "J.-C. Dupont" """
        prenom_abbrv = scu.abbrev_prenom(scu.format_prenom(self.prenom))
        return (prenom_abbrv + " " + self.get_nom_fmt()).strip()

    def get_nomcomplet(self):
        "Prénom et nom complets"
        return scu.format_prenom(self.prenom) + " " + self.get_nom_fmt()

    # nomnoacc était le nom en minuscules sans accents (inutile)

    def change_user_name(self, new_user_name: str):
        """Modify user name, update all relevant tables.
        commit session.
        """
        # Safety check
        new_user_name = new_user_name.strip()
        if (
            not is_valid_user_name(new_user_name)
            or User.query.filter_by(user_name=new_user_name).count() > 0
        ):
            raise ValueError("invalid user_name")
        # Le user_name est utilisé dans d'autres tables (sans être une clé)
        # BulAppreciations.author
        # EntrepriseHistorique.authenticated_user
        # EtudAnnotation.author
        # ScolarNews.authenticated_user
        # Scolog.authenticated_user
        from app.models import (
            BulAppreciations,
            EtudAnnotation,
            ScolarNews,
            Scolog,
        )
        from app.entreprises.models import EntrepriseHistorique

        try:
            # Update all instances of EtudAnnotation
            db.session.query(BulAppreciations).filter(
                BulAppreciations.author == self.user_name
            ).update({BulAppreciations.author: new_user_name})
            db.session.query(EntrepriseHistorique).filter(
                EntrepriseHistorique.authenticated_user == self.user_name
            ).update({EntrepriseHistorique.authenticated_user: new_user_name})
            db.session.query(EtudAnnotation).filter(
                EtudAnnotation.author == self.user_name
            ).update({EtudAnnotation.author: new_user_name})
            db.session.query(ScolarNews).filter(
                ScolarNews.authenticated_user == self.user_name
            ).update({ScolarNews.authenticated_user: new_user_name})
            db.session.query(Scolog).filter(
                Scolog.authenticated_user == self.user_name
            ).update({Scolog.authenticated_user: new_user_name})
            # And update ourself:
            self.user_name = new_user_name
            db.session.add(self)
            db.session.commit()
        except (
            IntegrityError,
            DataError,
            DatabaseError,
            OperationalError,
            ProgrammingError,
            StatementError,
            InterfaceError,
        ) as exc:
            db.session.rollback()
            raise exc


class AnonymousUser(AnonymousUserMixin):
    "Notre utilisateur anonyme"

    def has_permission(self, perm, dept=None):  # pylint: disable=unused-argument
        "always false, anonymous has no permission"
        return False

    def is_administrator(self):
        "always false, anonymous is not admin"
        return False


login.anonymous_user = AnonymousUser


class Role(ScoDocModel):
    """Roles for ScoDoc"""

    id = db.Column(db.Integer, primary_key=True)
    name = db.Column(db.String(64), unique=True, nullable=False, index=True)
    default = db.Column(db.Boolean, default=False, index=True)
    permissions = db.Column(db.BigInteger)  # 64 bits
    users = db.relationship("User", secondary="user_role", viewonly=True)

    def __init__(self, **kwargs):
        super(Role, self).__init__(**kwargs)
        if self.permissions is None:
            self.permissions = 0

    def __repr__(self):
        return "<Role {} perm={:0{w}b}>".format(
            self.name,
            self.permissions & ((1 << Permission.NBITS) - 1),
            w=Permission.NBITS,
        )

    def __str__(self):
        return f"{self.name}: perm={', '.join(Permission.permissions_names(self.permissions))}"

    def to_dict(self) -> dict:
        "As dict. Convert permissions to names."
        return {
            "id": self.id,
            "role_name": self.name,  # pour être cohérent avec partion_name, etc.
            "permissions": Permission.permissions_names(self.permissions),
        }

    def add_permission(self, perm: int):
        "Add permission to role"
        self.permissions |= perm

    def remove_permission(self, perm: int):
        "Remove permission from role"
        self.permissions = self.permissions & ~perm

    def reset_permissions(self):
        "Remove all permissions from role"
        self.permissions = 0

    def get_named_permissions(self) -> list[str]:
        "List of the names of the permissions associated to this rôle"
        return Permission.permissions_names(self.permissions)

    def set_named_permissions(self, permission_names: list[str]):
        """Set permissions, given as a list of permissions names.
        Raises ScoValueError if invalid permission."""
        self.permissions = 0
        for permission_name in permission_names:
            permission = Permission.get_by_name(permission_name)
            if permission is None:
                raise ScoValueError("set_named_permissions: invalid permission name")
            self.permissions |= permission

    def has_permission(self, perm: int) -> bool:
        "True if role as this permission"
        return self.permissions & perm == perm

    @staticmethod
    def reset_standard_roles_permissions(reset_permissions=True):
        """Create default roles if missing, then, if reset_permissions,
        reset their permissions to default values.
        """
        Role.reset_roles_permissions(
            SCO_ROLES_DEFAULTS, reset_permissions=reset_permissions
        )

    @staticmethod
    def reset_roles_permissions(roles_perms: dict[str, tuple], reset_permissions=True):
        """Ajoute les permissions aux roles
        roles_perms : { "role_name" : (permission, ...) }
        reset_permissions : si vrai efface permissions déja existantes
        Si le role n'existe pas, il est (re) créé.
        """
        default_role = "Observateur"
        for role_name, permissions in roles_perms.items():
            role = Role.query.filter_by(name=role_name).first()
            if role is None:
                role = Role(name=role_name)
                role.default = role.name == default_role
                db.session.add(role)
            if reset_permissions:
                role.reset_permissions()
                for perm in permissions:
                    role.add_permission(perm)
                db.session.add(role)

        db.session.commit()

    @staticmethod
    def ensure_standard_roles():
        """Create default roles if missing"""
        Role.reset_standard_roles_permissions(reset_permissions=False)

    @staticmethod
    def get_named_role(name):
        """Returns existing role with given name, or None."""
        return Role.query.filter_by(name=name).first()


class UserRole(ScoDocModel):
    """Associate user to role, in a dept.
    If dept is None, the role applies to all departments (eg super admin).
    """

    id = db.Column(db.Integer, primary_key=True)
    user_id = db.Column(db.Integer, db.ForeignKey("user.id"))
    role_id = db.Column(db.Integer, db.ForeignKey("role.id"))
    dept = db.Column(db.String(64))  # dept acronym ou NULL
    user = db.relationship(
        User, backref=db.backref("user_roles", cascade="all, delete-orphan")
    )
    role = db.relationship(
        Role, backref=db.backref("user_roles", cascade="all, delete-orphan")
    )

    def __repr__(self):
        return f"<UserRole u={self.user} r={self.role} dept={self.dept}>"

    @staticmethod
    def role_dept_from_string(role_dept: str):
        """Return tuple (role, dept) from the string
        role_dept, of the forme "Role_Dept".
        role is a Role instance, dept is a string, or None.
        """
        fields = role_dept.strip().split("_", 1)
        # maxsplit=1, le dept peut contenir un "_"
        if len(fields) != 2:
            current_app.logger.warning(
                f"auth: role_dept_from_string:  Invalid role_dept '{role_dept}'"
            )
            raise ScoValueError("Invalid role_dept")
        role_name, dept = fields
        dept = dept.strip() if dept else ""
        if dept == "":
            dept = None

        role = Role.query.filter_by(name=role_name).first()
        if role is None:
            raise ScoValueError(f"role {role_name} does not exists")
        return (role, dept)


def get_super_admin():
    """L'utilisateur admin (ou le premier, s'il y en a plusieurs).
    Utilisé par les tests unitaires et le script de migration.
    """
    admin_role = Role.query.filter_by(name="SuperAdmin").first()
    assert admin_role
    admin_user = (
        User.query.join(UserRole)
        .filter((UserRole.user_id == User.id) & (UserRole.role_id == admin_role.id))
        .first()
    )
    assert admin_user
    return admin_user


def send_notif_desactivation_user(user: User):
    """Envoi un message mail de notification à l'admin et à l'adresse du compte désactivé"""
    recipients = user.get_emails() + [current_app.config.get("SCODOC_ADMIN_MAIL")]
    txt = [
        f"""Le compte ScoDoc '{user.user_name}' associé à votre adresse <{user.email}>""",
        """a été désactivé par le système car son mot de passe n'était pas valide.\n""",
        """Contactez votre responsable pour le ré-activer.\n""",
        """Ceci est un message automatique, ne pas répondre.""",
    ]
    txt = "\n".join(txt)
    email.send_email(
        f"ScoDoc: désactivation automatique du compte {user.user_name}",
        email.get_from_addr(),
        recipients,
        txt,
    )
    return txt