from rest_framework.permissions import BasePermission


class HasProjectRole(BasePermission):
    """Restrict project objects to their members; directors retain global scope."""

    message = "You are not a member of this project."

    def has_permission(self, request, view):
        return bool(request.user and request.user.is_authenticated)

    def has_object_permission(self, request, view, obj):
        user = request.user
        if user.is_superuser or getattr(user, "organization_role", "staff") == "director":
            return True
        project = getattr(obj, "project", obj)
        membership = project.team_members.filter(user=user).first()
        if not membership:
            return False
        if request.method in ("GET", "HEAD", "OPTIONS"):
            return True
        return membership.role in ("owner", "manager")