from rest_framework import permissions


class IsAppStaff(permissions.BasePermission):
    """Superusers, Django staff, and accounts with the app's staff role."""

    message = "Staff only."

    def has_permission(self, request, view):
        user = request.user
        return bool(
            user and user.is_authenticated and user.is_app_staff
        )