# support/permissions.py
from rest_framework.permissions import BasePermission, SAFE_METHODS

# Roles that can modify tickets (tune to your org)
SUPPORT_WRITE_ROLES = {
    "admin", "pincode_head", "district_head", "state_head", "vertical_head", "vendor"
}

class SupportWritePermission(BasePermission):
    """
    - SAFE (GET/HEAD/OPTIONS): allowed if authenticated.
    - WRITE (POST/PATCH/PUT/DELETE): only if user.role in SUPPORT_WRITE_ROLES.
    """
    def has_permission(self, request, view):
        user = getattr(request, "user", None)
        if request.method in SAFE_METHODS:
            return bool(user and user.is_authenticated)
        return bool(user and getattr(user, "role", None) in SUPPORT_WRITE_ROLES)