def require_tenant(request):
    """Ensure that the request has an active tenant/organization context."""
    tenant_id = getattr(request, 'tenant_id', None)
    if not tenant_id and hasattr(request, 'user') and request.user.is_authenticated:
        tenant_id = getattr(request.user, 'current_organization_id', None)
        request.tenant_id = tenant_id
    
    if not tenant_id:
        from core.exceptions import BadRequestException
        raise BadRequestException("No active organization context found. Set X-Tenant-ID header.")
    return tenant_id

def is_org_admin(user, organization_id) -> bool:
    """Check if user has admin/owner privileges in the organization."""
    if user.is_superuser:
        return True
    from modules.team.models import TeamMember
    member = TeamMember.objects.filter(
        user=user,
        tenant_id=organization_id,
        role__in=['OWNER', 'ADMIN']
    ).first()
    return member is not None


def get_user_role(user, organization_id) -> str | None:
    """Get user's role in the organization, or None if not a member."""
    from modules.team.models import TeamMember
    member = TeamMember.objects.filter(
        user=user,
        tenant_id=organization_id
    ).first()
    return member.role if member else None


import functools

def require_role(min_role: str):
    """
    Decorator factory that enforces a minimum role for an endpoint.
    Roles (lowest to highest): GUEST < MEMBER < HR < MANAGER < ADMIN < OWNER
    Superusers bypass this check.
    """
    ROLE_HIERARCHY = ['GUEST', 'MEMBER', 'HR', 'MANAGER', 'ADMIN', 'OWNER']
    
    def decorator(func):
        @functools.wraps(func)
        def wrapper(request, *args, **kwargs):
            tenant_id = require_tenant(request)
            role = get_user_role(request.user, tenant_id)
            
            # Superusers bypass role checks
            if request.user.is_superuser:
                return func(request, *args, **kwargs)
            
            if role is None:
                from core.exceptions import ForbiddenException
                raise ForbiddenException("You are not a member of this organization.")
            
            min_idx = ROLE_HIERARCHY.index(min_role)
            user_idx = ROLE_HIERARCHY.index(role) if role in ROLE_HIERARCHY else -1
            
            if user_idx < min_idx:
                from core.exceptions import ForbiddenException
                raise ForbiddenException(f"This action requires {min_role} role or higher.")
            
            return func(request, *args, **kwargs)
        return wrapper
    return decorator


def require_admin(func):
    """Shorthand for require_role('ADMIN')"""
    return require_role('ADMIN')(func)


def require_manager(func):
    """Shorthand for require_role('MANAGER')"""
    return require_role('MANAGER')(func)


def require_org_owner(func):
    """Shorthand for require_role('OWNER')"""
    return require_role('OWNER')(func)