from rest_framework import permissions


class CanUpload(permissions.BasePermission):
    """Only uploader/staff/admin accounts may add items to the library."""

    message = "Your account is not allowed to upload."

    def has_permission(self, request, view):
        user = request.user
        return bool(user and user.is_authenticated and user.can_upload)


class IsUploaderOrStaffOrReadOnly(permissions.BasePermission):
    """Owners and staff can change an item; everyone can read."""

    message = "Only the uploader or staff can change this item."

    def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        user = request.user
        if not (user and user.is_authenticated):
            return False
        if user.is_superuser or user.role == user.ROLE_STAFF:
            return True
        return obj.uploaded_by_id == user.id