from rest_framework.permissions import BasePermission, SAFE_METHODS


class IsAdmin(BasePermission):
    """
    Permission check for Admin users only.
    """
    def has_permission(self, request, view):
        return request.user and request.user.is_authenticated and (request.user.role == 'ADMIN' or request.user.is_superuser)


class IsRestaurantOwner(BasePermission):
    """
    Permission check for Restaurant Owner users.
    """
    def has_permission(self, request, view):
        return request.user and request.user.is_authenticated and request.user.role == 'RESTAURANT_OWNER'


class IsOwnerOrAdminOrReadOnly(BasePermission):
    """
    Object-level permission for Restaurant Owner or Admin.
    Read-only for everyone else.
    """
    def has_permission(self, request, view):
        # Allow read for everyone
        if request.method in SAFE_METHODS:
            return True
        # Write requires authentication
        return request.user and request.user.is_authenticated

    def has_object_permission(self, request, view, obj):
        # Read permissions for any request
        if request.method in SAFE_METHODS:
            return True
        
        # Admin can do anything
        if request.user.role == 'ADMIN' or request.user.is_superuser:
            return True
        
        # Check if user is the owner
        if hasattr(obj, 'owner'):
            return obj.owner == request.user
        
        # For booking/menu items, check restaurant owner
        if hasattr(obj, 'restaurant'):
            return obj.restaurant.owner == request.user
        
        return False


class IsCustomer(BasePermission):
    """
    Permission check for Customer users.
    """
    def has_permission(self, request, view):
        return request.user and request.user.is_authenticated and request.user.role == 'CUSTOMER'


class CanManageBooking(BasePermission):
    """
    Permission for managing bookings.
    - Customers can view/create their own bookings
    - Restaurant owners can view/update bookings for their restaurants
    - Admins can manage all bookings
    """
    def has_permission(self, request, view):
        return request.user and request.user.is_authenticated

    def has_object_permission(self, request, view, obj):
        user = request.user
        
        # Admin can do anything
        if user.role == 'ADMIN' or user.is_superuser:
            return True
        
        # Restaurant owner can manage their restaurant's bookings
        if user.role == 'RESTAURANT_OWNER':
            return obj.restaurant.owner == user
        
        # Customer can manage their own bookings
        if user.role == 'CUSTOMER':
            # Read and cancel only for customers
            if request.method in SAFE_METHODS or request.method == 'DELETE':
                return obj.customer == user
        
        return False


class IsRestaurantOwnerOrAdmin(BasePermission):
    """
    Permission for Restaurant/Hotel Owner or Admin access.
    """
    def has_permission(self, request, view):
        if not request.user or not request.user.is_authenticated:
            return False
        return request.user.role in ['ADMIN', 'RESTAURANT_OWNER', 'HOTEL_OWNER'] or request.user.is_superuser