from uuid import UUID

from fastapi import HTTPException, status
from sqlalchemy import select
from sqlalchemy.orm import Session

from app.core.permissions import Permission, has_permission
from app.models.branch import Branch
from app.models.membership import Membership, MembershipBranch
from app.models.user import User
from app.services.workspace import get_membership_for_business


def require_permission(db: Session, user: User, business_id: UUID, permission: Permission) -> Membership:
    membership = get_membership_for_business(db, user, business_id)
    if membership is None:
        raise HTTPException(status.HTTP_404_NOT_FOUND, "Business workspace not found.")
    if not has_permission(membership.role, permission):
        raise HTTPException(status.HTTP_403_FORBIDDEN, "You do not have permission for this action.")
    return membership


def require_branch_access(db: Session, membership: Membership, business_id: UUID, branch_id: UUID) -> Branch:
    branch = db.scalar(select(Branch).where(Branch.id == branch_id, Branch.business_id == business_id, Branch.is_active.is_(True)))
    if branch is None:
        raise HTTPException(status.HTTP_422_UNPROCESSABLE_ENTITY, "Invalid branch for this business.")
    if membership.all_branches:
        return branch
    assigned = db.scalar(select(MembershipBranch.id).where(MembershipBranch.membership_id == membership.id, MembershipBranch.branch_id == branch_id))
    if assigned is None:
        raise HTTPException(status.HTTP_403_FORBIDDEN, "You do not have access to this branch.")
    return branch