from functools import wraps
from django.contrib import messages
from django.core.exceptions import PermissionDenied
from django.shortcuts import redirect
from core.project_utils import get_current_project, get_membership

def _has_project_role(request, roles):
    if not request.user.is_authenticated:
        return False
    if request.user.is_superuser:
        return True
    project = get_current_project(request)
    membership = get_membership(request.user, project)
    return bool(membership and membership.role in roles)

def admin_required(view_func):
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect("accounts:login")
        if not _has_project_role(request, {"admin"}):
            messages.error(request, "Only the Company Admin can perform this action.")
            raise PermissionDenied
        return view_func(request, *args, **kwargs)
    return wrapper

def accountant_required(view_func):
    """Project Admin or Accountant."""
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect("accounts:login")
        if not _has_project_role(request, {"admin", "accountant"}):
            messages.error(request, "Only Company Admins or Accountants can add or edit entries.")
            raise PermissionDenied
        return view_func(request, *args, **kwargs)
    return wrapper

def any_authenticated(view_func):
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return redirect("accounts:login")
        if not request.user.is_superuser and get_membership(request.user, get_current_project(request)) is None:
            messages.error(request, "You do not have access to an active company.")
            raise PermissionDenied
        return view_func(request, *args, **kwargs)
    return wrapper