"""
CLM API Permissions - v1.

مجوزهای دسترسی ماژول مدیریت قراردادها.

NOTE: Uses PermissionService from the platform's custom RBAC system
instead of Django's built-in has_perm() which only checks auth_permission table.
"""
from rest_framework.permissions import BasePermission

from apps.core.permission.services import PermissionService


class CLMBasePermission(BasePermission):
    """مجوز پایه ماژول CLM."""
    module = "clm"
    resource = ""

    def has_permission(self, request, view):
        if not request.user or not request.user.is_authenticated:
            return False
        if request.user.is_superuser:
            return True
        if not self.resource:
            return True

        prefix = f"{self.module}.{self.resource}"
        if request.method in ("GET", "HEAD", "OPTIONS"):
            return PermissionService.has_any_permission(
                request.user,
                [f"{prefix}.list", f"{prefix}.read"],
            )
        return PermissionService.has_any_permission(
            request.user,
            [f"{prefix}.create", f"{prefix}.update", f"{prefix}.delete", f"{prefix}.manage"],
        )


class CanManageContracts(CLMBasePermission):
    """مجوز مدیریت قراردادها."""
    resource = "contract"


class CanApproveContracts(CLMBasePermission):
    """مجوز تأیید قراردادها."""

    def has_permission(self, request, view):
        if not request.user or not request.user.is_authenticated:
            return False
        if request.user.is_superuser:
            return True
        return PermissionService.has_permission(request.user, "clm.contract.approve")


class CanManageTemplates(CLMBasePermission):
    """مجوز مدیریت قالب‌ها."""
    resource = "template"


class CanManageAmendments(CLMBasePermission):
    """مجوز مدیریت الحاقیه‌ها."""
    resource = "amendment"


class CanViewReports(CLMBasePermission):
    """مجوز مشاهده گزارشات."""

    def has_permission(self, request, view):
        if not request.user or not request.user.is_authenticated:
            return False
        if request.user.is_superuser:
            return True
        return PermissionService.has_any_permission(
            request.user,
            ["clm.report.list", "clm.report.read"],
        )