from rest_framework import permissions
from questbanker_api.utils import get_current_user

class IsPostOnly(permissions.BasePermission):
    """
        Object-level permission to only allow post 
    """

    def has_permission(self, request, view):
        if request.method == 'POST':
            return True

class IsUNCDFPartner(permissions.BasePermission):
    """
    Permission class for UNCDF partner users
    """
    def has_permission(self, request, view):
        if not request.user or not request.user.is_authenticated:
            return False
            
        # Check if user belongs to Finwise organization
        try:
            # Get organization ID directly from user model
            organisation_id = request.user.user_organisation_branch.branch_organisation.id
            if organisation_id != 139:  # Finwise organization ID
                return False
        except Exception as e:
            print(f"Error getting organization ID: {e}")
            return False
            
        # Check if user has partner role with UNCDF
        try:
            from users.models import UserAssignedRole
            user_role = UserAssignedRole.objects.filter(
                user=request.user,
                is_active=True
            ).first()
            
            if not user_role:
                return False
                
            role = user_role.assigned_role
            is_partner = role.role_type == 'partner'
            is_uncdf = role.partner_name == 'UNCDF'
            result = is_partner and is_uncdf
            
            print(f"Permission check - User: {request.user.username}, Org: {organisation_id}, Role: {role.role_name}, Type: {role.role_type}, Partner: {role.partner_name}, Result: {result}")
            
            return result
                   
        except Exception as e:
            print(f"Error checking user role: {e}")
            return False

class IsPartnerRestricted(permissions.BasePermission):
    """
    Permission class to restrict partner users to specific endpoints
    """
    def has_permission(self, request, view):
        if not request.user or not request.user.is_authenticated:
            return False
            
        # Check if user is a partner
        try:
            from organisations.models import UserAssignedRole
            user_role = UserAssignedRole.objects.filter(
                user=request.user,
                is_active=True
            ).first()
            
            if not user_role:
                return True  # Not a partner, allow normal access
                
            role = user_role.assigned_role
            if role.role_type == 'partner':
                # Check if current endpoint is allowed
                current_path = request.path_info
                allowed_endpoints = [
                    '/api/uncdf-dashboard/',
                    '/api/token-auth/',
                    '/api/verify-otp/',
                    '/api/chat/',
                ]
                
                return any(current_path.startswith(endpoint) for endpoint in allowed_endpoints)
            
            return True  # Not a partner, allow normal access
            
        except:
            return True  # Error case, allow access