from rest_framework import permissions
from apps.profiles.models import InstitutionMember


class IsOrganizerAdminOrReadOnly(permissions.BasePermission):
    """
    Allows read-only access for any request.
    Restricts write/delete access to institution admins, editors, or system superusers.
    """
    def has_permission(self, request, view):
        if request.method in permissions.SAFE_METHODS:
            return True
        return request.user and request.user.is_authenticated

    def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        
        user = request.user
        if not user or not user.is_authenticated:
            return False
            
        if user.is_superuser or getattr(user, 'user_type', None) in ['super_admin', 'regional_admin']:
            return True
            
        organizer = getattr(obj, 'organizer', None)
        if not organizer:
            return False
            
        # Check if user is an admin or editor of this institution
        return InstitutionMember.objects.filter(
            institution=organizer,
            user=user,
            role__in=['admin', 'editor']
        ).exists()


class IsOrganizerOrStaff(permissions.BasePermission):
    """
    Permission for viewing attendees / participants list.
    """
    def has_permission(self, request, view):
        return request.user and request.user.is_authenticated

    def has_object_permission(self, request, view, obj):
        user = request.user
        if user.is_superuser or getattr(user, 'user_type', None) in ['super_admin', 'regional_admin']:
            return True
            
        organizer = getattr(obj, 'organizer', None)
        if not organizer:
            return False
            
        return InstitutionMember.objects.filter(
            institution=organizer,
            user=user,
            role__in=['admin', 'editor']
        ).exists()