
    όi                     v    d dl mZmZ d dlmZ d dlmZmZ d dlm	Z	 defdZ
defdZdefd	Zd
ede	e   fdZy)    )HTTPExceptionRequest)ObjectId)
StaffModel
collection)Optionalrequestc           	        K   | j                   j                  d      }|r|j                  d      sy|j                  d      d   }|dk(  rdddgdd	d
}|| j                  _        |S 	 t        j                  t        |      dd      }|syt        |j                  d|j                  d                  |j                  dd      |j                  dg       |j                  dd      |j                  dd	      |j                  dd      d}|| j                  _        |S # t        $ r t        j                  |dd      }Y w xY ww)u   
    Cố gắng lấy actor hiện tại từ Authorization header.
    Không raise lỗi ngay, để middleware log vẫn ghi được cả request thất bại.
    AuthorizationzBearer N    1adminAdmin )idrolepermissionsnameemailstaff)_idr   )r   r   r   r   r   r   r   Staffr   statusinactive)r   r   r   r   r   r   )headersget
startswithsplitstateactorr   find_oner   	Exceptionstr)r	   auth_headeruser_idr!   users        2/var/www/pod-logistic/pod-api/utils/auth_helper.pyget_current_actor_optionalr)      sD    
 //%%o6Kk44Y?$Q'G #~#9
 $E""8G+<g#NO  $((5$((4.12)xxr2)'2&((8Z0E  GMML!  E""'7#CDEs+   A%E(!D  	BE !EEEEc                    K   t        |        d{   }|st        dd      |j                  d      dk7  r!|j                  d      dk7  rt        d	d
      |S 7 Jw)u   
    Dùng cho các API cần chặn quyền thật sự.
    Nếu không có actor hoặc actor không hợp lệ thì raise 401/403.
    N  Unauthorizedstatus_codedetailr   r   r   active  zAccount is inactive)r)   r   r   )r	   r!   s     r(   get_current_actor_requiredr2   3   s`     
 -W55ENCC yyG#		((;x(G4IJJL 6s   AAAApermission_namec                       dt         f fd}|S )Nr	   c                    K   | j                   _        t        |        d {   }|d   dk(  r|S t        j                  |d         r|S t        dd      7 6w)Nr   r   r   r1   zForbidden: No permissionr-   )r    required_permissionr2   r   check_accessr   )r	   current_userr3   s     r(   
dependencyz'requires_permission.<locals>.dependencyE   sf     ,;)7@@ 7* ""<#>P4NOO As    AA7A)r   )r3   r9   s   ` r(   requires_permissionr:   D   s    P' P      r8   client_actor_idc                     t        | xs i j                  d      xs d      j                         }t        |xs d      j                         }|st        dd      |st        dd      ||k7  rt        dd	      |S )
Nr   r   r+   r,   r-   i  zactorId is requiredr1   zForbidden: actor mismatch)r$   r   stripr   )r8   r<   expected_actor_idactual_actor_ids       r(   assert_actor_matchrA   W   s    \/R44T:@bAGGI//R0668ONCC4IJJ++4OPPr;   N)fastapir   r   bson.objectidr   model.staff_modelr   r   typingr   r)   r2   r$   r:   dictrA    r;   r(   <module>rH      sM    * " 4 *g *Zg " &T HSM r;   