from urllib.parse import urlparse

from django.conf import settings
from django.core.checks import Error, Tags, Warning, register
from django.core.validators import validate_email
from django.core.exceptions import ValidationError


@register(Tags.security, deploy=True)
def production_security_checks(app_configs, **kwargs):
    issues = []
    if settings.DEBUG:
        return issues

    if settings.TURNSTILE_REQUIRED and not (
        settings.TURNSTILE_SITE_KEY and settings.TURNSTILE_SECRET_KEY
    ):
        issues.append(Error(
            "Turnstile je obvezen, vendar oba ključa nista nastavljena.",
            id="weindorfer.E001",
        ))
    if settings.EMAIL_BACKEND.endswith("smtp.EmailBackend"):
        if not settings.EMAIL_HOST or not settings.EMAIL_HOST_USER or not settings.EMAIL_HOST_PASSWORD:
            issues.append(Error(
                "SMTP gostitelj, uporabnik in geslo morajo biti v produkciji nastavljeni.",
                id="weindorfer.E002",
            ))
        if settings.EMAIL_USE_TLS == settings.EMAIL_USE_SSL:
            issues.append(Error(
                "Za SMTP vključite natanko eno od EMAIL_USE_TLS ali EMAIL_USE_SSL.",
                id="weindorfer.E003",
            ))
    recipient = settings.CONTACT_RECIPIENT
    if not recipient:
        issues.append(Warning(
            "CONTACT_RECIPIENT ni nastavljen; uporabljen bo naslov iz CMS-a.",
            id="weindorfer.W001",
        ))
    else:
        try:
            validate_email(recipient)
        except ValidationError:
            issues.append(Error("CONTACT_RECIPIENT ni veljaven e-poštni naslov.", id="weindorfer.E004"))
    if not settings.REQUIRE_ADMIN_2FA:
        issues.append(Error("Dvostopenjska prijava za CMS je izključena.", id="weindorfer.E005"))
    if settings.ENABLE_DJANGO_ADMIN:
        issues.append(Warning(
            "Django admin je javno dosegljiv, čeprav ga Wagtail stran ne potrebuje.",
            id="weindorfer.W002",
        ))
    site_url = urlparse(settings.WAGTAILADMIN_BASE_URL)
    if site_url.scheme != "https":
        issues.append(Error("SITE_URL mora v produkciji uporabljati HTTPS.", id="weindorfer.E006"))
    if "*" in settings.ALLOWED_HOSTS:
        issues.append(Error("ALLOWED_HOSTS v produkciji ne sme vsebovati '*'.", id="weindorfer.E007"))
    return issues