from rest_framework.permissions import SAFE_METHODS, BasePermission


class IsManager(BasePermission):
    """Grants access only to users bound to the built-in Manager role.

    Reserved for the handful of things that are conceptually "the owner-level
    system role", not a general capability — everything else should use
    HasPermission/HasPermissionOrReadOnly with a specific codename instead, so
    access stays configurable via custom roles.
    """

    def has_permission(self, request, view):
        return bool(
            request.user
            and request.user.is_authenticated
            and request.user.is_manager
        )


def HasPermission(codename):
    """Returns a permission class requiring the given codename on every request."""

    class _HasPermission(BasePermission):
        def has_permission(self, request, view):
            return bool(
                request.user
                and request.user.is_authenticated
                and request.user.has_perm_code(codename)
            )

    _HasPermission.__name__ = f'HasPermission_{codename}'
    return _HasPermission


def HasPermissionOrReadOnly(codename):
    """Any authenticated user can read; the given codename is required to write."""

    class _HasPermissionOrReadOnly(BasePermission):
        def has_permission(self, request, view):
            if not (request.user and request.user.is_authenticated):
                return False
            if request.method in SAFE_METHODS:
                return True
            return request.user.has_perm_code(codename)

    _HasPermissionOrReadOnly.__name__ = f'HasPermissionOrReadOnly_{codename}'
    return _HasPermissionOrReadOnly