"""权限校验中间件。"""
import functools
from flask import request

from insurance.utils.response import error

# 角色 -> 权限映射
ROLE_PERMISSIONS = {
    "super_admin": ["*"],
    "admin": [
        "kb_manage", "log_view", "user_view", "config_view",
        "team_stats", "chat", "proposal",
    ],
    "manager": ["chat", "proposal", "kb_view", "team_stats"],
    "sales": ["chat", "proposal"],
    "client": ["chat"],
}


def require_permission(permission: str):
    """权限校验装饰器。无权限返回 1004。"""
    def decorator(f):
        @functools.wraps(f)
        def decorated(*args, **kwargs):
            user = getattr(request, "_insurance_user", None)
            if not user:
                return error(1002, "未授权，请重新登录"), 401

            role = user.get("role", "")
            perms = ROLE_PERMISSIONS.get(role, [])

            if "*" in perms or permission in perms:
                return f(*args, **kwargs)

            return error(1004, "权限不足，您没有访问该功能的权限"), 403
        return decorated
    return decorator