"""
HRM API Permissions - v1.

مجوزهای دسترسی ماژول منابع انسانی.

NOTE: Uses PermissionService from the platform's custom RBAC system
instead of Django's built-in has_perm() which only checks auth_permission table.
"""
from rest_framework.permissions import BasePermission

from apps.core.permission.services import PermissionService


class HRMBasePermission(BasePermission):
    """
    مجوز پایه ماژول HRM.
    
    Subclasses must define `module` and `resource` attributes.
    Read methods (GET/HEAD/OPTIONS) check `.list` and `.read` permissions.
    Write methods check `.create`, `.update`, `.delete`, `.manage` permissions.
    """
    module = "hrm"
    resource = ""

    def has_permission(self, request, view):
        if not request.user or not request.user.is_authenticated:
            return False
        if request.user.is_superuser:
            return True
        if not self.resource:
            return True

        prefix = f"{self.module}.{self.resource}"
        if request.method in ("GET", "HEAD", "OPTIONS"):
            return PermissionService.has_any_permission(
                request.user,
                [f"{prefix}.list", f"{prefix}.read"],
            )
        return PermissionService.has_any_permission(
            request.user,
            [f"{prefix}.create", f"{prefix}.update", f"{prefix}.delete", f"{prefix}.manage"],
        )


class CanManageOrganization(HRMBasePermission):
    """مجوز مدیریت ساختار سازمانی."""
    resource = "organization"


class CanManageEmployees(HRMBasePermission):
    """مجوز مدیریت کارمندان."""
    resource = "employee"


class CanManagePositions(HRMBasePermission):
    """مجوز مدیریت پست‌ها."""
    resource = "position"


class CanManageAttendance(HRMBasePermission):
    """مجوز مدیریت حضور و غیاب."""
    resource = "attendance"


class CanManageLeave(HRMBasePermission):
    """مجوز مدیریت مرخصی."""
    resource = "leave"


class CanManagePayroll(HRMBasePermission):
    """مجوز مدیریت حقوق و دستمزد."""
    resource = "payroll"


class IsEmployeeOwner(HRMBasePermission):
    """مجوز خود کارمند برای مشاهده اطلاعات خود."""

    def has_object_permission(self, request, view, obj):
        if not request.user or not request.user.is_authenticated:
            return False
        if request.user.is_superuser:
            return True
        # Check if the user owns this employee record
        user_id = str(request.user.id)
        obj_user_id = str(getattr(obj, "user_id", None) or "")
        if user_id == obj_user_id:
            return True
        # Fall back to manage permission
        return PermissionService.has_permission(request.user, "hrm.employee.manage")