from rest_framework.permissions import BasePermission, SAFE_METHODS
from apps.profiles.models.institution import Institution, InstitutionMember


class IsInstitutionAdminOrReadOnly(BasePermission):
    """
    Read access is open to all.
    Write/modify access is restricted to Platform Admins (super_admin, regional_admin)
    or delegated Institution Administrators.
    """
    def has_permission(self, request, view):
        if request.method in SAFE_METHODS:
            return True
        return bool(request.user and request.user.is_authenticated and request.user.is_active)

    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True
        if not request.user or not request.user.is_authenticated or not request.user.is_active:
            return False
        
        # Super admin and regional admin have global write authority
        if getattr(request.user, 'is_super_admin', False) or getattr(request.user, 'is_regional_admin', False):
            return True

        # Check if obj is Institution or a related model with an institution foreign key
        institution = obj if isinstance(obj, Institution) else getattr(obj, 'institution', None)
        if not institution:
            return False

        return institution.is_admin(request.user)


class IsInstitutionEditorOrReadOnly(BasePermission):
    """
    Read access is open to all.
    Write/modify access is permitted for Platform Admins, Institution Admins, and Institution Editors.
    """
    def has_permission(self, request, view):
        if request.method in SAFE_METHODS:
            return True
        return bool(request.user and request.user.is_authenticated and request.user.is_active)

    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True
        if not request.user or not request.user.is_authenticated or not request.user.is_active:
            return False

        if getattr(request.user, 'is_super_admin', False) or getattr(request.user, 'is_regional_admin', False):
            return True

        institution = obj if isinstance(obj, Institution) else getattr(obj, 'institution', None)
        if not institution:
            return False

        return institution.is_editor(request.user)


class CanManageInstitutionMembers(BasePermission):
    """
    Permits only Platform Admins and Institution Admins to manage and delegate member roles.
    """
    def has_permission(self, request, view):
        return bool(request.user and request.user.is_authenticated and request.user.is_active)

    def has_object_permission(self, request, view, obj):
        if not request.user or not request.user.is_authenticated or not request.user.is_active:
            return False

        if getattr(request.user, 'is_super_admin', False) or getattr(request.user, 'is_regional_admin', False):
            return True

        institution = obj if isinstance(obj, Institution) else getattr(obj, 'institution', None)
        if not institution:
            return False

        return institution.is_admin(request.user)