from django.conf import settings
from django.conf.urls.static import static
from django.contrib import admin
from django.urls import path, include
from drf_spectacular.views import SpectacularAPIView, SpectacularRedocView
from rest_framework.permissions import AllowAny

from apps.core.media_views import serve_media

urlpatterns = [
    path("admin/", admin.site.urls),

    # API routes
    path("api/", include("apps.core.urls")),
    path("api/", include("apps.hr.urls")),
    path("api/", include("apps.projects.urls")),
    path("api/", include("apps.events.urls")),
    path("api/", include("apps.meetings.urls")),
    path("api/", include("apps.tasks.urls")),
    path("api/", include("apps.asset_management.urls")),
    path("api/", include("apps.procurements.urls")),
    path("api/", include("apps.administrations.urls")),
    path("api/", include("apps.publications.urls")),
    path("api/", include("apps.contacts.urls")),
    path("api/", include("apps.companies.urls")),
    path("api/", include("apps.activities.urls")),
    path("api/chat/", include("apps.chat.urls")),
    path("api/", include("apps.chatbot.urls")),
    path("api/", include("apps.tools.urls")),
    path("api/", include("apps.notifications.urls")),
    path("api/", include("apps.analytics.urls")),
    path("api/", include("apps.disseminations.urls")),
    path("api/", include("apps.finance.urls")),
    path("api/", include("apps.accounting.urls")),
    path("api/", include("apps.donors.staff_urls")),
    path("api/donor/", include("apps.donors.urls")),

    # API Documentation — schema endpoints stay public for client tooling
    path("api/schema/", SpectacularAPIView.as_view(permission_classes=[AllowAny]), name="schema"),
    path("api/redoc/", SpectacularRedocView.as_view(permission_classes=[AllowAny]), name="redoc"),

    # Authorized media. Resolves each file's owning organization and refuses
    # callers outside it — see apps.core.media_views for why this exists.
    path("api/media/<path:path>", serve_media, name="serve-media"),
]

# DEBUG-only convenience: unauthenticated static serving of MEDIA_ROOT, matching
# what WhiteNoise does in production while MEDIA_SERVE_UNAUTHENTICATED is True.
# Never enable alongside a deployment that has cut over to /api/media/.
if settings.DEBUG and getattr(settings, "MEDIA_SERVE_UNAUTHENTICATED", True):
    urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)