
    2fh                         d dl mZ ddlmZ  G d dej                        Z G d dej                        Z G d d	ej                        Z G d
 dej                        Zy)    )permissions   )UserProfilec                       e Zd ZdZd Zy)IsSuperAdminOrAdminz
    Permission class that allows:
    - Super Admins: Full database access
    - Admins: Hierarchical access (own data + created users)
    c                    |j                   j                  sy	 |j                   j                  }|j                  ry	 |j                   j                  j                  d      j                         S # t        j
                  $ r Y Iw xY w)NFTAdminname)	useris_authenticatedprofilesuper_adminr   DoesNotExistgroupsfilterexists)selfrequestviewr   s       /backend/users/permissions.pyhas_permissionz"IsSuperAdminOrAdmin.has_permission   sz    ||,,	ll**G"" # ||""))w)7>>@@	 '' 		s   "A1 1BBN__name__
__module____qualname____doc__r        r   r   r      s    Ar   r   c                       e Zd ZdZd Zd Zy)IsSuperAdminOrOwnerOrCreatedByz
    Object-level permission that allows:
    - Super Admins: Access to ANY object
    - Admins: Access to own objects and objects of users they created
    c                    |j                   j                  sy	 |j                   j                  }|j                  ry	 |j                   j                  j                  d      j                         rt        |d      r8||j                   k(  ry	 |j                  }|j                  |j                   k(  ry	 t        |d      r|j                  |j                   k(  S t        |d      rA|j                   |j                   k(  xs& | j                  |j                   |j                         S y# t        j
                  $ r Y w xY w# t        j
                  $ r Y w xY w)NFTr	   r
   username
created_byr   )r   r   r   r   r   r   r   r   r   hasattrr$   _can_access_user_data)r   r   r   objr   target_profiles         r   has_object_permissionz4IsSuperAdminOrOwnerOrCreatedBy.has_object_permission"   s.   ||,,	ll**G"" # <<%%7%3::<sJ'',,&%([[N%00GLL@# A sL)~~55sF#xx7<</e43M3Mgll\_\d\d3ee1 '' 		 #// s#   "D( %E (D?>D?EEc                 l    	 |j                   }|j                  |k(  S # t        j                  $ r Y yw xY wz3Check if current_user can access target_user's dataFr   r$   r   r   r   current_usertarget_userr   s       r   r&   z4IsSuperAdminOrOwnerOrCreatedBy._can_access_user_dataE   ;    	!))G%%55'' 		    33Nr   r   r   r   r)   r&   r   r   r   r!   r!      s    !Fr   r!   c                       e Zd ZdZd Zd Zy)IsAdminOrOwnerOrCreatedByz
    Custom permission to allow:
    - Admins can access everything
    - Users can access their own data
    - Users can access data of users they created
    c                 
   |j                   j                  j                  d      j                         rt	        |d      r8||j                   k(  ry	 |j
                  }|j                  |j                   k(  ry	 t	        |d      r|j                  |j                   k(  S t	        |d      rA|j                   |j                   k(  xs& | j                  |j                   |j                         S y# t        j                  $ r Y w xY w)Nr	   r
   r#   Tr$   r   F)
r   r   r   r   r%   r   r$   r   r   r&   )r   r   r   r'   r   s        r   r)   z/IsAdminOrOwnerOrCreatedBy.has_object_permissionU   s    <<%%7%3::<sJ'',,&!kkG))W\\9# : sL)~~55sF#xx7<</e43M3Mgll\_\d\d3ee #// s   %C, ,DDc                 l    	 |j                   }|j                  |k(  S # t        j                  $ r Y yw xY wr+   r,   r-   s       r   r&   z/IsAdminOrOwnerOrCreatedBy._can_access_user_datan   r0   r1   Nr2   r   r   r   r4   r4   M   s    2r   r4   c                       e Zd ZdZd Zy)IsAdminRolez:
    Permission class to check if user has Admin role
    c                     |j                   j                  xr4 |j                   j                  j                  d      j	                         S )Nr	   r
   )r   r   r   r   r   )r   r   r   s      r   r   zIsAdminRole.has_permissionz   s9    ||,,b1D1D1K1KQX1K1Y1`1`1bbr   Nr   r   r   r   r8   r8   v   s    cr   r8   N)	rest_frameworkr   modelsr   BasePermissionr   r!   r4   r8   r   r   r   <module>r=      sY    & A+44 A,0[%?%? 0d' : : 'Rc+,, cr   