from rest_framework import permissions


class CanCreateUsers(permissions.BasePermission):
    """Permission to check if user can create other users"""
    
    def has_permission(self, request, view):
        if request.method == 'POST':
            return request.user and request.user.is_authenticated and (
                request.user.can_create_users or request.user.is_superuser
            )
        return True


class CanEditUsers(permissions.BasePermission):
    """Permission to check if user can edit/delete other users"""
    
    def has_object_permission(self, request, view, obj):
        user = request.user
        
        # Superusuarios pueden hacer cualquier cosa
        if user.is_superuser:
            return True
        
        if user.can_create_users:
            if obj.is_superuser:
                return False
            return True
        
        # Usuarios normales solo pueden editar su propio perfil
        # pero no pueden editar sus propios permisos
        if obj == user:
            # Verificar que no esté intentando modificar permisos
            if request.method in ['PUT', 'PATCH']:
                permission_fields = [
                    'can_add_documents', 'can_create_folders', 'can_download',
                    'can_share_by_email',
                    'can_view', 'can_edit_folders', 'can_edit_documents',
                    'can_delete_documents', 'can_delete_folders', 'can_create_users'
                ]
                for field in permission_fields:
                    if field in request.data:
                        return False
            return True
        
        return False


class IsOwnerOrAdmin(permissions.BasePermission):
    """Permission to check if user is owner or admin"""
    
    def has_object_permission(self, request, view, obj):
        user = request.user
        
        # Superusuarios y usuarios con can_create_users pueden ver cualquier perfil
        if user.is_superuser or user.can_create_users:
            return True
        
        # Usuarios normales solo pueden ver/editar su propio perfil
        if request.method in permissions.SAFE_METHODS:
            return obj == user
        
        return obj == user