from rest_framework.permissions import SAFE_METHODS, BasePermission

from apps.core.permissions import user_is_hr_authority, user_managed_department_ids


class EmployeeAccessPermission(BasePermission):
    """Separate public directory access from confidential HR mutation authority."""

    MANAGER_EDITABLE_FIELDS = {"position", "phone_extension"}

    def has_permission(self, request, view):
        if not request.user.is_authenticated:
            return False
        if view.action in {"list", "retrieve"}:
            return True
        if view.action == "create":
            return user_is_hr_authority(request.user)
        if view.action == "destroy":
            return False
        return True

    def has_object_permission(self, request, view, obj):
        user = request.user
        if request.method in SAFE_METHODS:
            return True
        if user_is_hr_authority(user):
            return True
        if obj.primary_department_id not in user_managed_department_ids(user):
            return False
        return set(request.data).issubset(self.MANAGER_EDITABLE_FIELDS)