from rest_framework.permissions import BasePermission


class IsCoreSuperAdmin(BasePermission):
    """
    Core APIs are reserved for Django superusers with a bound Employee merchant.
    """

    message = "需要 superadmin 权限并绑定有效员工商户"

    def has_permission(self, request, view):
        user = request.user
        if not user or not user.is_authenticated:
            return False
        if not user.is_superuser:
            return False

        employee = getattr(user, "employee", None)
        if employee is None:
            return False
        if getattr(employee, "merchant_id", None) is None:
            return False

        request.core_merchant = employee.merchant
        return True