from rest_framework import permissions


class CommerceAccessPermission(permissions.BasePermission):
    """All employees may read; writes require staff or Django model permission."""

    action_to_permission = {
        "create": "add",
        "update": "change",
        "partial_update": "change",
        "destroy": "delete",
    }

    def has_permission(self, request, view):
        user = request.user
        if not user or not user.is_authenticated:
            return False
        if request.method in permissions.SAFE_METHODS:
            return True
        if user.is_staff:
            return True

        action = getattr(view, "action", None)
        operation = self.action_to_permission.get(action)
        queryset = getattr(view, "queryset", None)
        model = getattr(queryset, "model", None)
        if not operation or model is None:
            return False
        opts = model._meta
        return user.has_perm(f"{opts.app_label}.{operation}_{opts.model_name}")