"""
CODH Users Permissions
Custom permission classes
"""

from rest_framework import permissions


class IsSuperAdmin(permissions.BasePermission):
    """Only super admins"""
    
    def has_permission(self, request, view):
        return request.user.is_authenticated and (
            request.user.is_superuser or request.user.role == 'super_admin'
        )


class IsAdminOrAbove(permissions.BasePermission):
    """Admin or higher roles"""
    
    def has_permission(self, request, view):
        if not request.user.is_authenticated:
            return False
        
        return request.user.is_superuser or request.user.role in [
            'super_admin', 'admin'
        ]


class IsStaff(permissions.BasePermission):
    """Staff or higher roles"""
    
    def has_permission(self, request, view):
        if not request.user.is_authenticated:
            return False
        
        return request.user.is_superuser or request.user.role in [
            'super_admin', 'admin', 'staff', 'developer', 'finance'
        ]


class HasPermission(permissions.BasePermission):
    """Check if user has specific permission"""
    
    permission_codename = None
    
    def has_permission(self, request, view):
        if not request.user.is_authenticated:
            return False
        
        if self.permission_codename:
            return request.user.has_permission(self.permission_codename)
        
        # Check view attribute
        codename = getattr(view, 'required_permission', None)
        if codename:
            return request.user.has_permission(codename)
        
        return True


class IsOwnerOrAdmin(permissions.BasePermission):
    """Object owner or admin"""
    
    def has_object_permission(self, request, view, obj):
        if request.user.is_superuser or request.user.role in ['super_admin', 'admin']:
            return True
        
        # Check if object has user attribute
        if hasattr(obj, 'user'):
            return obj.user == request.user
        
        # Check if object is user
        if isinstance(obj, type(request.user)):
            return obj == request.user
        
        return False


class IsClient(permissions.BasePermission):
    """Only clients (for client-specific endpoints)"""
    
    def has_permission(self, request, view):
        return request.user.is_authenticated and request.user.role == 'client'