"""
Permisos personalizados — API REST v1
======================================
"""

from rest_framework.permissions import BasePermission


class EsPaciente(BasePermission):
    """Solo usuarios con rol paciente."""

    def has_permission(self, request, view):
        return (
            request.user
            and request.user.is_authenticated
            and request.user.rol == "paciente"
        )


class EsDoctora(BasePermission):
    """Solo la doctora."""

    def has_permission(self, request, view):
        return (
            request.user
            and request.user.is_authenticated
            and request.user.rol == "doctora"
        )


class EsAdmin(BasePermission):
    """Solo administradores."""

    def has_permission(self, request, view):
        return (
            request.user
            and request.user.is_authenticated
            and request.user.rol == "admin"
        )


class EsDoctoraOAdmin(BasePermission):
    """Doctora o administrador."""

    def has_permission(self, request, view):
        return (
            request.user
            and request.user.is_authenticated
            and request.user.rol in ("doctora", "admin")
        )


class EsOwnerODoctoraOAdmin(BasePermission):
    """
    Object-level: propietario del recurso, doctora o admin.
    El objeto debe tener .paciente o .user apuntando al propietario.
    """

    def has_object_permission(self, request, view, obj):
        user = request.user
        owner = getattr(obj, "paciente", None) or getattr(obj, "user", None)
        if owner and owner.pk == user.pk:
            return True
        return user.rol in ("doctora", "admin")