from django.shortcuts import redirect
from django.urls import reverse


class ForcePasswordChangeMiddleware:
    """After an admin set a temporary password, the user must choose a new one first."""

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        user = request.user
        if user.is_authenticated and user.must_change_password:
            allowed = {reverse("accounts:password_change"), reverse("accounts:logout"), reverse("core:healthz")}
            if request.path not in allowed:
                return redirect("accounts:password_change")
        return self.get_response(request)