from rest_framework.permissions import BasePermission, SAFE_METHODS


class IsTicketOwnerOrStaff(BasePermission):
    """
    Grants access to the ticket creator, member of affiliated institution, or staff/admin.
    """
    def has_permission(self, request, view):
        return bool(request.user and request.user.is_authenticated and request.user.is_active)

    def has_object_permission(self, request, view, obj):
        if not request.user or not request.user.is_authenticated:
            return False

        if request.user.is_staff or getattr(request.user, 'is_super_admin', False) or getattr(request.user, 'is_regional_admin', False):
            return True

        if obj.user == request.user:
            return True

        if obj.institution and obj.institution.is_editor(request.user):
            return True

        return False