"""
Custom permissions for task-related views.
"""

from rest_framework import permissions


class IsOwnerOrReadOnlyIfShared(permissions.BasePermission):
    """
    Permission that allows:
    - Owners: full access (read, update, delete)
    - Shared users: read-only access

    SECURITY: Prevents users with shared access from modifying tasks/tags they don't own.
    """

    def has_object_permission(self, request, view, obj):
        # Read permissions are allowed for shared tasks/tags
        if request.method in permissions.SAFE_METHODS:
            # Allow if user owns the object OR if it's shared with them
            return (
                obj.user == request.user or
                hasattr(obj, 'shares') and obj.shares.filter(shared_with=request.user).exists() or
                hasattr(obj, 'task') and obj.task.shares.filter(shared_with=request.user).exists()
            )

        # Write permissions (PUT, PATCH, DELETE) only for owners
        return obj.user == request.user