"""`@require_perm` Flask decorator (group-based RBAC)."""

from __future__ import annotations

from collections.abc import Callable
from functools import wraps
from typing import ParamSpec, TypeVar

from flask import abort
from flask_login import current_user

from mimic.rbac.matrix import Permission

P = ParamSpec("P")
R = TypeVar("R")


def require_perm(perm: Permission) -> Callable[[Callable[P, R]], Callable[P, R]]:
    """Reject the request with 401/403 unless the user holds `perm`."""

    def _decorate(view: Callable[P, R]) -> Callable[P, R]:
        @wraps(view)
        def _wrapped(*args: P.args, **kwargs: P.kwargs) -> R:
            user = current_user
            if not getattr(user, "is_authenticated", False):
                abort(401)
            permissions: frozenset[Permission] = getattr(user, "permissions", frozenset())
            if perm not in permissions:
                abort(403)
            return view(*args, **kwargs)

        return _wrapped

    return _decorate


def user_has(perm: Permission, permissions: frozenset[Permission]) -> bool:
    """Pure helper, easier to unit-test than the decorator."""
    return perm in permissions