from rest_framework import permissions


class FolderPermissions(permissions.BasePermission):
    """Custom permissions for Folder operations"""

    def has_permission(self, request, view):
        print("DEBUG action:", view.action)

        if not request.user.is_authenticated:
            return False

        # Lectura (métodos seguros: GET, HEAD, OPTIONS)
        if request.method in permissions.SAFE_METHODS:
            return getattr(request.user, "can_view", True)

        # Crear carpetas
        if view.action == "create":
            return getattr(request.user, "can_create_folders", False)

        # Acciones personalizadas
        if view.action in ["add_user_access", "remove_user_access"]:
            return getattr(request.user, "can_edit_folders", False) or request.user.is_staff

        # Update
        if view.action in ["update", "partial_update"]:
            return getattr(request.user, "can_edit_folders", False) or request.user.is_staff

        # Delete
        if view.action == "destroy":
            return getattr(request.user, "can_delete_folders", False) or request.user.is_staff

        # Para otras acciones no especificadas
        return True

    def has_object_permission(self, request, view, obj):
        """Check if user has permission to access specific folder"""
        if not request.user.is_authenticated:
            return False
        
        # Admins can do anything
        if request.user.is_staff or request.user.is_superuser:
            return True
        
        # Check if user has access to folder
        if not obj.user_has_access(request.user):
            return False
        
        # Check view permission
        if request.method in permissions.SAFE_METHODS:
            return request.user.can_view
        
        # Check edit permission
        if request.method in ['PUT', 'PATCH']:
            return request.user.can_edit_folders
        
        # Check delete permission
        if request.method == 'DELETE':
            return request.user.can_delete_folders
        
        # Para acciones personalizadas
        if view.action in ["add_user_access", "remove_user_access"]:
            return request.user.can_edit_folders
        
        return False


class DocumentPermissions(permissions.BasePermission):
    """Custom permissions for Document operations"""
    
    def has_permission(self, request, view):
        if not request.user.is_authenticated:
            return False

        # Lectura: cualquier autenticado con permiso de ver
        if request.method in permissions.SAFE_METHODS:
            return getattr(request.user, "can_view", True)

        # Acciones personalizadas de acceso
        if view.action in ["add_user_access", "remove_user_access", "create_version"]:
            return (
                getattr(request.user, "can_edit_documents", False)
                or request.user.is_staff
                or request.user.is_superuser
            )

        if view.action == "send_by_email":
            return (
                getattr(request.user, "can_share_by_email", False)
                or request.user.is_staff
                or request.user.is_superuser
            )

        # Crear documento
        if view.action == "create":
            return getattr(request.user, "can_add_documents", False)

        return True
    
    def has_object_permission(self, request, view, obj):
        if not request.user.is_authenticated:
            return False

        # Admins pueden todo
        if request.user.is_staff or request.user.is_superuser:
            return True

        # Acceso básico al documento
        if not obj.user_has_access(request.user):
            return False

        # Lectura
        if request.method in permissions.SAFE_METHODS:
            return getattr(request.user, "can_view", True)

        # Acciones personalizadas de acceso
        if view.action in ["add_user_access", "remove_user_access", "create_version"]:
            return (
                obj.created_by == request.user
                or getattr(request.user, "can_edit_documents", False)
            )

        if view.action == "send_by_email":
            return getattr(request.user, "can_share_by_email", False)

        # Edición
        if request.method in ["PUT", "PATCH"]:
            return getattr(request.user, "can_edit_documents", False)

        # Eliminación
        if request.method == "DELETE":
            return getattr(request.user, "can_delete_documents", False)

        return False


class CanDownload(permissions.BasePermission):
    """Permission to check if user can download documents"""
    
    def has_permission(self, request, view):
        return request.user and request.user.is_authenticated and request.user.can_download
    
    def has_object_permission(self, request, view, obj):
        if request.user.is_staff or request.user.is_superuser:
            return True
        return obj.user_has_access(request.user) and request.user.can_download