o
    ^h+                     @   s  d dl mZ d dlmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ ddlmZmZ dd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Z d d! Z!d"d# Z"d$d% Z#G d&d' d'eZ$G d(d) d)eZ%G d*d+ d+eZ&G d,d- d-eZ'G d.d/ d/eZ(G d0d1 d1e&Z)G d2d3 d3e)Z*G d4d5 d5e)Z+G d6d7 d7e)Z,G d8d9 d9e&Z-d:d; Z.d<S )=    )wraps)login_required)LoginRequiredMixin)PermissionDenied)messages)redirect)HttpResponseForbidden)loader)
Permission)user_passes_test)
Department   )GroupPermissionManagerDepartmentPermissionAssignmentc                 C   
   t | dS )z1Check if user has access to financial informationview_billinghas_permissionuser r   4/var/www/html/optinet_system/accounts/permissions.pyhas_financial_access      
r   c                 C   r   )z/Check if user can assign tickets to techniciansassign_ticketsr   r   r   r   r   can_assign_tickets   r   r   c                 C   r   )z"Check if user can delete customersdelete_customersr   r   r   r   r   can_delete_customers   r   r   c                 C   s0   | j rdS t| do| jo| jjo| jjjdkS )zCheck if user is an adminTemployee_profile
Management)is_superuserhasattrr   
departmentnamer   r   r   r   is_admin   s   
r$   c           
      C   sf  t  }| js|S | jrtjjddjddd}t |S | j }|D ]]}|j	 }|D ]S}|
|j |jdrF|
d|jdd   q+|jd	rY|
d
|jdd   q+|jdrl|
d|jdd   q+|jdr~|
d|jdd   q+q"| jr|h d t| dr| jr| jjr| jj}tjj|ddd}|D ]	}	|
|	jj q|S )zAGet all permissions for a user based on their role and departmentT)	is_activer#   )flatadd_create_   Nchange_edit_   view_   delete_>   view_ticketsview_calendarview_customersr   )r"   permission__is_active
permission)setis_authenticatedr    r   objectsfiltervalues_listgroupsallpermissionsaddcodename
startswithis_staffupdater!   r   r"   r   select_relatedr4   r#   )
r   r<   all_permissionsuser_groupsgroupgroup_permissionspermr"   assigned_permissions
assignmentr   r   r   get_user_permissions)   sD   

rJ   c                 C   sh   | j sdS | jr
dS d|v r| |rdS ng d}|D ]}| | d| r+ dS qt| }||v S )z'Check if user has a specific permissionFT.)		customersticketsexpenditurebillinghrpaymentssettingsnetworknotifications)r6   r    has_permrJ   )r   r4   common_appsappuser_permissionsr   r   r   r   \   s   
r   c                        fdd}|S )z(Decorator to require specific permissionc                       t  t fdd}|S )Nc                    sV   | j d  s| j d  st| j  r#| g|R i |S td  d)Nz
customers.ztickets.Permission '
' required)r   rU   r   r   requestargskwargs)r4   	view_funcr   r   _wrapped_viewx   s   
z=permission_required.<locals>.decorator.<locals>._wrapped_viewr   r   ra   rb   r4   ra   r   	decoratorw   s   z&permission_required.<locals>.decoratorr   )r4   rg   r   re   r   permission_requiredu   s   rh   c                     rY   )z5Decorator to require any of the specified permissionsc                    rZ   )Nc                    s|   t | j g }D ]}t|ttfr|| q	|| q	t fdd|D s3tdd	| | g|R i |S )Nc                 3       | ]}| v V  qd S Nr   .0rG   rX   r   r   	<genexpr>       zTany_permission_required.<locals>.decorator.<locals>._wrapped_view.<locals>.<genexpr>#One of these permissions required: , )
rJ   r   
isinstancelisttupleextendappendanyr   join)r^   r_   r`   flattened_permissionsrG   )r<   ra   rm   r   rb      s   
zAany_permission_required.<locals>.decorator.<locals>._wrapped_viewrc   rd   r<   rf   r   rg      s   z*any_permission_required.<locals>.decoratorr   )r<   rg   r   rz   r   any_permission_required   s   r{   c                 C      | j S )z1Check if user has management/superuser privilegesr    r   r   r   r   has_management_privileges      r~   c                 C   r|   )z?Check if user can access settings - superusers have full accessr}   r   r   r   r   can_access_settings   r   r   c                 C   r|   )z@Check if user can access HR module - superusers have full accessr}   r   r   r   r   can_access_hr   r   r   c                 C   r|   )z<Check if user has admin access - superusers have full accessr}   r   r   r   r   has_admin_access   r   r   c                       $   e Zd ZdZdZ fddZ  ZS )PermissionRequiredMixinz$Mixin to require specific permissionNc                    sP   |j js|  S | jrt|j | jstd| j dt j|g|R i |S )Nr[   r\   )r   r6   handle_no_permissionrh   r   r   superdispatchselfr^   r_   r`   	__class__r   r   r      s
   z PermissionRequiredMixin.dispatch)__name__
__module____qualname____doc__rh   r   __classcell__r   r   r   r   r          r   c                       s$   e Zd ZdZg Z fddZ  ZS )AnyPermissionRequiredMixinz1Mixin to require any of the specified permissionsc                    sh   |j js|  S | jr't|j  t fdd| jD s'tdd| j t j	|g|R i |S )Nc                 3   ri   rj   r   rk   rm   r   r   rn      ro   z6AnyPermissionRequiredMixin.dispatch.<locals>.<genexpr>rp   rq   )
r   r6   r   permissions_requiredrJ   rw   r   rx   r   r   r   r   rm   r   r      s   
z#AnyPermissionRequiredMixin.dispatch)r   r   r   r   r   r   r   r   r   r   r   r      r   r   c                           e Zd ZdZ fddZ  ZS )EmployeeRequiredMixinz(Mixin to require employee authenticationc                    R   |j js|  S t|j dr|j jst|d tdS t j	|g|R i |S )Nr   z*This page is only accessible to employees.zaccounts:employee_login)
r   r6   r   r!   r   r   errorr   r   r   r   r   r   r   r         zEmployeeRequiredMixin.dispatchr   r   r   r   r   r   r   r   r   r   r          r   c                       r   )CustomerRequiredMixinz(Mixin to require customer authenticationc                    r   )Ncustomer_profilez*This page is only accessible to customers.zcustomers:customer_login)
r   r6   r   r!   r   r   r   r   r   r   r   r   r   r   r      r   zCustomerRequiredMixin.dispatchr   r   r   r   r   r      r   r   c                       r   )AdminRequiredMixinz/Mixin to require admin/superuser authenticationc                    sJ   |j js|  S |j js|j jst|d tt j	|g|R i |S )Nz,This page requires administrator privileges.)
r   r6   r   r    r@   r   r   r   r   r   r   r   r   r   r      s   zAdminRequiredMixin.dispatchr   r   r   r   r   r      r   r   c                       r   )DepartmentRequiredMixinz/Mixin to require specific department membershipNc                    sl   t  j|g|R i |}t|dr|jdkr|S |jj}|jr'|jj| jkr4t	
|d| j d t|S )Nstatus_code   z This page is only accessible to z staff.)r   r   r!   r   r   r   r"   r#   department_namer   r   r   )r   r^   r_   r`   responseemployeer   r   r   r      s   z DepartmentRequiredMixin.dispatch)r   r   r   r   r   r   r   r   r   r   r   r      r   r   c                   @      e Zd ZdZdZdS )ManagementRequiredMixinz1Mixin to require Management department membershipr   Nr   r   r   r   r   r   r   r   r   r         r   c                   @   r   )TechnicianRequiredMixinz1Mixin to require Technician department membership
TechnicianNr   r   r   r   r   r   	  r   r   c                   @   r   )MarketingRequiredMixinz0Mixin to require Marketing department membership	MarketingNr   r   r   r   r   r     r   r   c                       r   )FinancialAccessMixinz-Mixin to require financial access permissionsc                    sP   t  j|g|R i |}t|dr|jdkr|S t|js&t|d t|S )Nr   r   z;You do not have permission to access financial information.)	r   r   r!   r   r   r   r   r   r   )r   r^   r_   r`   r   r   r   r   r     s   
zFinancialAccessMixin.dispatchr   r   r   r   r   r     r   r   c                    s   t  t fdd}|S )z?Decorator to ensure customers can only access their own objectsc                    s    | g|R i |S rj   r   r]   rf   r   r   rb   !  s   z+customer_owns_object.<locals>._wrapped_viewrc   rd   r   rf   r   customer_owns_object  s   r   N)/	functoolsr   django.contrib.auth.decoratorsr   django.contrib.auth.mixinsr   django.core.exceptionsr   django.contribr   django.shortcutsr   django.httpr   django.templater	   django.contrib.auth.modelsr
   r   	hr.modelsr   modelsr   r   r   r   r   r$   rJ   r   rh   r{   r~   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   <module>   sF    3