# api/permissions.py
from rest_framework.permissions import BasePermission

# class IsRoleAdminForWrite(BasePermission):
#     """
#     Read for anyone authenticated (tweak as needed).
#     Write (PATCH/PUT/DELETE/POST) only if request.user.role == 'admin'.
#     """
#     def has_permission(self, request, view):
#         if request.method in ("PATCH", "PUT", "DELETE", "POST"):
#             user = getattr(request, "user", None)
#             return bool(user and getattr(user, "role", None) == "admin")
#         return True


# class IsRoleAdmin(BasePermission):
#     def has_permission(self, request, view):
#         u = request.user
#         if not u or not u.is_authenticated:
#             return False
#         # accept either Django staff/superuser OR your app roles
#         return bool(getattr(u, "is_staff", False) or getattr(u, "is_superuser", False) or getattr(u, "role", "") in {"admin","super_admin"})


# api/permissions.py
from typing import Iterable
from rest_framework.permissions import BasePermission, SAFE_METHODS

ALLOWED_ADMIN_ROLES: Iterable[str] = {"admin", "super_admin"}  # tweak/extend as needed


def _has_admin_role(user) -> bool:
    role = (getattr(user, "role", "") or "").strip().lower()
    return role in {r.lower() for r in ALLOWED_ADMIN_ROLES}


class IsRoleAdmin(BasePermission):
    """
    Allow only:
      - Django staff/superuser, OR
      - users whose `role` is in ALLOWED_ADMIN_ROLES.
    Deny if not authenticated.
    """
    def has_permission(self, request, view) -> bool:
        u = getattr(request, "user", None)
        if not u or not u.is_authenticated:
            return False
        return bool(getattr(u, "is_staff", False) or getattr(u, "is_superuser", False) or _has_admin_role(u))


class IsRoleAdminForWrite(BasePermission):
    """
    Read-only for authenticated users; write only for admins.
    Reads require authentication (fixes your current 'return True' for anyone).
    """
    def has_permission(self, request, view) -> bool:
        u = getattr(request, "user", None)
        if not u or not u.is_authenticated:
            return False

        if request.method in SAFE_METHODS:
            return True

        # Write operations require admin role OR Django staff/superuser
        return bool(getattr(u, "is_staff", False) or getattr(u, "is_superuser", False) or _has_admin_role(u))