# -*- coding: utf-8 -*-
# pyrefly: ignore [missing-import]
from odoo import http, exceptions
# pyrefly: ignore [missing-import]
from odoo.http import request

class EducationDemoController(http.Controller):

    @http.route('/demo/login', type='http', auth='public', methods=['POST'], website=True, csrf=False)
    def demo_login(self, role=None, **kw):
        """
        Secure Demo Login Endpoint.
        Accepts only 'role' (admin, faculty, student).
        Redirects to safe destinations.
        """
        if not role:
            raise exceptions.AccessDenied("Missing role parameter.")

        # Map allowed roles to specific, pre-configured demo user logins
        # Do not allow arbitrary user login
        demo_accounts = {
            'admin': {
                'login': 'demo.admin',
                'password': 'Demo@Admin2026',
                'redirect': '/web'
            },
            'faculty': {
                'login': 'demo.faculty',
                'password': 'Demo@Faculty2026',
                'redirect': '/web'
            },
            'student': {
                'login': 'demo.student',
                'password': 'Demo@Student2026',
                'redirect': '/my/education/dashboard'
            }
        }

        if role not in demo_accounts:
            raise exceptions.AccessDenied("Invalid role.")

        account = demo_accounts[role]
        db = request.db

        if not db:
            # If no DB is set, force it to the single DB (we can get it if there's only one)
            dbs = http.db_list()
            if len(dbs) == 1:
                db = dbs[0]
            else:
                return request.redirect('/web/login')

        try:
            credential = {
                'login': account['login'],
                'password': account['password'],
                'type': 'password'
            }
            if request.env.cr:
                auth_info = request.session.authenticate(request.env, credential)
                uid = auth_info.get('uid') if auth_info else request.session.uid
            else:
                import odoo
                with odoo.modules.registry.Registry(db).cursor() as cr:
                    env = odoo.api.Environment(cr, None, {})
                    auth_info = request.session.authenticate(env, credential)
                    request._save_session(env)
                    request.session.db = db
                    uid = auth_info.get('uid') if auth_info else request.session.uid
        except Exception:
            uid = False

        if not uid:
            # Maybe the demo user doesn't exist yet, or password was changed.
            # Redirect to login with error.
            return request.redirect('/web/login?error=Demo account not properly configured.')

        # Protect against open redirects: Only use our pre-defined safe redirects
        return request.redirect(account['redirect'])