from rest_framework.permissions import BasePermission


class CanViewReports(BasePermission):
    """Reports are for ADMIN and manager roles (TA_MANAGER, PROJECT_MANAGER, ...).

    Access is granted to admins, to any role whose name contains MANAGER
    (the convention already used across the app, e.g. JD posting), and to
    anyone explicitly holding the reports.view_reports permission."""

    message = "You do not have permission to view reports."

    def has_permission(self, request, view):
        user = request.user
        if not (user and user.is_authenticated):
            return False
        if user.is_superuser or getattr(user, "role", "") == "ADMIN":
            return True
        if "MANAGER" in (user.role or "").upper():
            return True
        return user.has_perm("reports.view_reports")