"""
Access control for Real Estate interface.
Handles user access management and permission checks.
"""

import logging
from typing import Dict, Any, List, Optional
from modules.datamodels.datamodelUam import User

logger = logging.getLogger(__name__)


class RealEstateAccess:
    """
    Access control class for Real Estate interface.
    Handles user access management and permission checks.
    """
    
    def __init__(self, currentUser: User, db):
        """Initialize with user context."""
        self.currentUser = currentUser
        self.mandateId = currentUser.mandateId
        self.userId = currentUser.id
        self.roleLabels = currentUser.roleLabels or []
        
        if not self.mandateId or not self.userId:
            raise ValueError("Invalid user context: mandateId and userId are required")
            
        self.db = db

    def uam(self, model_class: type, recordset: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
        """
        Unified user access management function that filters data based on user privileges.
        
        Args:
            model_class: Pydantic model class for the table
            recordset: Recordset to filter based on access rules
            
        Returns:
            Filtered recordset with access control attributes
        """
        filtered_records = []
        
        # System admins see all records
        if "sysadmin" in self.roleLabels:
            filtered_records = recordset
        # Admins see records in their mandate
        elif "admin" in self.roleLabels:
            filtered_records = [r for r in recordset if r.get("mandateId", "-") == self.mandateId]
        # Regular users see only their records
        else:
            filtered_records = [
                r for r in recordset 
                if r.get("mandateId", "-") == self.mandateId and r.get("_createdBy") == self.userId
            ]
        
        # Add access control attributes
        for record in filtered_records:
            record["_hideView"] = False
            record["_hideEdit"] = not self.canModify(model_class, record.get("id"))
            record["_hideDelete"] = not self.canModify(model_class, record.get("id"))
        
        return filtered_records

    def canModify(self, model_class: type, recordId: Optional[str] = None) -> bool:
        """Checks if the current user can modify records."""
        # System admins can modify all records
        if "sysadmin" in self.roleLabels:
            return True
            
        if recordId is not None:
            records = self.db.getRecordset(model_class, recordFilter={"id": recordId})
            if not records:
                return False
                
            record = records[0]
            
            # Admins can modify records in their mandate
            if "admin" in self.roleLabels and record.get("mandateId", "-") == self.mandateId:
                return True
                
            # Regular users can modify their own records
            if (record.get("mandateId", "-") == self.mandateId and 
                record.get("_createdBy") == self.userId):
                return True
                
            return False
        else:
            return True  # Regular users can create records