from rest_framework import permissions
from apps.profiles.models import InstitutionMember


class IsMeetingParticipantOrStaff(permissions.BasePermission):
    """
    Ensures the user belongs to either the requester or recipient institution,
    or is the creator / superuser.
    """
    def has_permission(self, request, view):
        return bool(request.user and request.user.is_authenticated)

    def has_object_permission(self, request, view, obj):
        user = request.user
        if user.is_superuser or getattr(user, 'user_type', None) in ['super_admin', 'regional_admin']:
            return True

        if obj.created_by == user:
            return True

        # Check if user is a member of requester or recipient institution
        return InstitutionMember.objects.filter(
            institution__in=[obj.requester_institution, obj.recipient_institution],
            user=user
        ).exists()


class CanManageMeeting(permissions.BasePermission):
    """
    Ensures user is an admin/editor of the requester or recipient institution.
    """
    def has_permission(self, request, view):
        return bool(request.user and request.user.is_authenticated)

    def has_object_permission(self, request, view, obj):
        user = request.user
        if user.is_superuser or getattr(user, 'user_type', None) in ['super_admin', 'regional_admin']:
            return True

        return InstitutionMember.objects.filter(
            institution__in=[obj.requester_institution, obj.recipient_institution],
            user=user,
            role__in=['admin', 'editor']
        ).exists()