"""Custody evidence queries; scoped application helpers use frozen center authorization."""
import hashlib
import json

from apps.access.authorization import authorized_queryset
from apps.customers.models import Customer
from apps.devices.locking import persisted_pk
from apps.devices.models import Device
from apps.organization.models import ServiceCenter
from .models import ServiceCase, ServiceCaseDeliveryRelease, ServiceCaseHandover, ServiceCaseHandoverAccessory, ServiceCaseClosure
from .queries import _saved, _rows

HANDOVER_PERMISSION = "service.handover_servicecase"
CLOSURE_PERMISSION = "service.close_servicecase"


def device_identity_fingerprint(device):
    """Confirmation digest, not an ownership claim or identity-document snapshot."""
    current = Device.objects.get(pk=persisted_pk(device, Device))
    identifiers = list(current.identifiers.filter(is_active=True).order_by("identifier_type", "pk").values_list("identifier_type", "identity_key"))
    facts = [str(current.pk), str(current.product_model_id), str(current.product_variant_id), identifiers]
    return hashlib.sha256(json.dumps(facts, separators=(",", ":")).encode()).hexdigest()


def authorized_delivery_cases(*, actor, permission=HANDOVER_PERMISSION):
    centers = authorized_queryset(user=actor, permission=permission, queryset=ServiceCenter.objects.all())
    return _rows().filter(service_center_id__in=centers.values("pk")).order_by("received_at", "job_number", "pk")


def _handovers():
    return ServiceCaseHandover.objects.select_related("service_case__customer", "service_case__company", "service_case__service_center",
        "service_case__device__product_model__brand", "recipient_customer", "handed_over_by", "delivery_release__quality_control__inspector")


def get_service_case_delivery_release(service_case):
    if not _saved(service_case, ServiceCase):
        return None
    return ServiceCaseDeliveryRelease.objects.select_related("service_case", "readied_by", "device__product_model__brand", "quality_control").filter(service_case=service_case).first()


def get_service_case_handover(service_case):
    return _handovers().filter(service_case=service_case).first() if _saved(service_case, ServiceCase) else None


def handover_accessories(handover):
    rows = ServiceCaseHandoverAccessory.objects.select_related("handover", "intake_accessory")
    return rows.filter(handover=handover) if _saved(handover, ServiceCaseHandover) else rows.none()


def get_service_case_closure(service_case):
    if not _saved(service_case, ServiceCase):
        return None
    return ServiceCaseClosure.objects.select_related("service_case__customer", "service_case__company", "service_case__service_center",
        "service_case__device__product_model__brand", "closed_by", "handover__handed_over_by").filter(service_case=service_case).first()


def _center_queue(service_center, state, actor, permission):
    rows = _rows() if actor is None else authorized_delivery_cases(actor=actor, permission=permission)
    rows = rows.filter(status=state).select_related("delivery_release__readied_by", "handover__handed_over_by", "closure__closed_by").order_by("received_at", "job_number", "pk")
    return rows.filter(service_center=service_center) if _saved(service_center, ServiceCenter) else rows.none()


def ready_for_delivery_cases_for_center(service_center, *, actor=None):
    return _center_queue(service_center, "READY_FOR_DELIVERY", actor, HANDOVER_PERMISSION)


def delivered_cases_for_center(service_center, *, actor=None):
    return _center_queue(service_center, "DELIVERED", actor, CLOSURE_PERMISSION)


def closed_cases_for_center(service_center, *, actor=None):
    return _center_queue(service_center, "CLOSED", actor, CLOSURE_PERMISSION)


def handover_history_for_customer(customer):
    """Trusted history for presenting Customer, including representative collection."""
    return _handovers().filter(service_case__customer=customer) if _saved(customer, Customer) else _handovers().none()