"""权限中间件依赖。"""

from __future__ import annotations

from enum import Enum

from fastapi import Depends, HTTPException
from sqlalchemy import and_, select
from sqlalchemy.ext.asyncio import AsyncSession

from ..core.database import get_db
from ..models import User, UserProject
from ..services.auth import parse_role_values
from .auth import get_current_user

MANAGER_ROLES = {"BOSS", "ADMIN"}


def _role_value(role: object) -> str:
    return role.value if isinstance(role, Enum) else str(role or "")


async def require_manager_user(
    current_user: User = Depends(get_current_user),
) -> User:
    """要求当前用户是管理角色。"""
    user_roles = set(parse_role_values(_role_value(current_user.role)))
    if not user_roles.intersection(MANAGER_ROLES):
        raise HTTPException(status_code=403, detail="Manager permission required")
    return current_user


async def require_self_or_manager(
    user_id: int,
    current_user: User = Depends(get_current_user),
) -> User:
    """要求“本人或管理角色”。"""
    user_roles = set(parse_role_values(_role_value(current_user.role)))
    if int(current_user.id) == int(user_id) or user_roles.intersection(MANAGER_ROLES):
        return current_user
    raise HTTPException(status_code=403, detail="No permission")


async def require_project_member_or_manager(
    project_id: str,
    current_user: User = Depends(get_current_user),
    db: AsyncSession = Depends(get_db),
) -> User:
    """
    要求为项目成员或管理角色。

    适用于所有带 `project_id` 的 mutation 端点。
    """
    user_roles = set(parse_role_values(_role_value(current_user.role)))
    if user_roles.intersection(MANAGER_ROLES):
        return current_user

    try:
        pid = int(project_id)
    except ValueError as exc:
        raise HTTPException(status_code=400, detail="Invalid project_id") from exc

    membership = await db.execute(
        select(UserProject.user_id).where(
            and_(
                UserProject.tenant_id == int(current_user.tenant_id),
                UserProject.project_id == pid,
                UserProject.user_id == int(current_user.id),
            )
        )
    )
    if membership.scalar_one_or_none() is None:
        raise HTTPException(status_code=403, detail="Project membership required")
    return current_user