"""Custom DRF permission classes using AppUser JWT."""
from rest_framework.permissions import BasePermission

from core.models import AppUser
from .auth_utils import decode_token


def _get_app_user(request) -> AppUser | None:
    """Extract and validate bearer token → return AppUser or None."""
    auth = request.META.get('HTTP_AUTHORIZATION', '')
    if not auth.startswith('Bearer '):
        return None
    payload = decode_token(auth[7:])
    if not payload or payload.get('type') != 'access':
        return None
    try:
        return AppUser.objects.get(id=payload['sub'], status='active')
    except AppUser.DoesNotExist:
        return None


class IsAppUser(BasePermission):
    """Any active app user (user, doctor, admin)."""
    message = 'Authentication required.'

    def has_permission(self, request, view):
        user = _get_app_user(request)
        if user is None:
            return False
        request.app_user = user
        return True


class IsAdminAppUser(BasePermission):
    """Requires admin role."""
    message = 'Admin access required.'

    def has_permission(self, request, view):
        user = _get_app_user(request)
        if user is None or user.role != 'admin':
            return False
        request.app_user = user
        return True


class IsDoctorOrAdmin(BasePermission):
    """Requires doctor or admin role."""
    message = 'Doctor access required.'

    def has_permission(self, request, view):
        user = _get_app_user(request)
        if user is None or user.role not in ('doctor', 'admin'):
            return False
        request.app_user = user
        return True