from django.contrib.auth.models import AbstractUser
from django.db import models


class CustomUser(AbstractUser):
    """The 4 roles required by the spec:
    Admin      -> full control
    Accountant -> income / expense / payment entry
    Member     -> can see own deposit + project report
    Viewer     -> read-only reports
    """

    class Role(models.TextChoices):
        ADMIN = "admin", "Admin"
        ACCOUNTANT = "accountant", "Accountant"
        MEMBER = "member", "Member"
        VIEWER = "viewer", "Viewer"

    role = models.CharField(max_length=20, choices=Role.choices, default=Role.ADMIN)
    phone = models.CharField(max_length=20, blank=True)
    photo = models.ImageField(upload_to="user_photos/", null=True, blank=True)

    class Meta:
        db_table = "accounts_user"

    def save(self, *args, **kwargs):
        # A Django superuser is always the platform's Application Owner —
        # force the display role to Admin so it can never show/behave as
        # Viewer, even if someone edits the role field directly later.
        if self.is_superuser:
            self.role = self.Role.ADMIN
        super().save(*args, **kwargs)

    def __str__(self):
        return self.get_full_name() or self.username

    @property
    def is_admin_role(self):
        return self.role == self.Role.ADMIN or self.is_superuser

    @property
    def is_accountant_role(self):
        return self.role in (self.Role.ADMIN, self.Role.ACCOUNTANT) or self.is_superuser

    @property
    def is_member_role(self):
        return self.role == self.Role.MEMBER

    @property
    def is_viewer_role(self):
        return self.role == self.Role.VIEWER