apiVersion: v1
data:
  permissions.py: |
    import re

    from rest_framework.permissions import BasePermission
    from rest_framework.request import Request

    class CompanyIdTokenBasedPermission(BasePermission):

      def has_permission_to_retrieve(self, request: Request, view) -> bool:
          validated_token = request.auth
          user_company_ids = validated_token.get('company_ids', [])
          company_id = request.query_params.get('company_id')

          if company_id is None:
              company_id = request.query_params.get('tenant_id')
          if company_id is None:
              company_id = request.query_params.get('tenant_identifier')
          if not company_id:
              return True

          return True


    class CompanyAttributeIdTokenBasedPermission(CompanyIdTokenBasedPermission):

      def has_permission_to_update(self, request: Request, view) -> bool:
          validated_token = request.auth
          user_company_ids = set(validated_token.get('company_ids', []))

          if isinstance(request.data, list):
              objects_ids = [obj.get("id") for obj in request.data]
          else:
              objects_ids = [request.data.get("id")]

          # Проверка, что множество компаний Пользователя включает множество затрагиваемых в БД
          objects = view.queryset.filter(id__in=objects_ids)
          affected_tenants = set(int(obj.tenant_identifier) for obj in objects)
          return affected_tenants.issubset(user_company_ids)



    class CompanyIdTokenBasedPermission(BasePermission):

        def has_permission_to_retrieve(self, request: Request, view) -> bool:
            validated_token = request.auth
            print(request.auth, "########################")
            user_company_ids = validated_token.get('company_ids', [])
            company_id = request.query_params.get('company_id')

            if company_id is None:
                company_id = request.query_params.get('tenant_id')
            if company_id is None:
                company_id = request.query_params.get('tenant_identifier')
            if not company_id:
                return True

            return int(company_id) in user_company_ids

        def has_permission_to_create(self, request: Request, view) -> bool:
            validated_token = request.auth
            affected_tenants = set()
            user_company_ids = set(validated_token.get('company_ids', []))

            if isinstance(request.data, list):
                for obj in request.data:
                    affected_tenants.add(obj.get("tenant_id"))
            else:
                affected_tenants.add(request.data.get("tenant_id"))
            # Проверка, что множество компаний Пользователя включает множество затрагиваемых полностью
            return affected_tenants.issubset(user_company_ids)

        def has_permission_to_update(self, request: Request, view) -> bool:
            validated_token = request.auth
            user_company_ids = set(validated_token.get('company_ids', []))

            if isinstance(request.data, list):
                objects_ids = [obj.get("id") for obj in request.data]
            else:
                objects_ids = [request.data.get("id")]

            # Проверка, что множество компаний Пользователя включает множество затрагиваемых в БД
            objects = view.queryset.filter(id__in=objects_ids)
            affected_tenants = set(int(obj.tenant_id) for obj in objects)
            return affected_tenants.issubset(user_company_ids)

        def has_object_permission(self, request, view, obj):
            validated_token = request.auth

            user_company_ids = {
                int(value)
                for value in
                validated_token.get("company_ids", [])
            }

            if hasattr(obj, "tenant_id"):
                tenant_id = int(getattr(obj, "tenant_id"))
                return tenant_id in user_company_ids

            return True

        def has_permission(self, request, view) -> bool:
            if request.auth is None:
                if request.user is None:
                    return False
                elif request.user.is_superuser:
                    return True

            if request.method == "GET":
                #return self.has_permission_to_retrieve(request, view)
                return True
            elif request.method == "POST":
                if re.fullmatch(".*/*/copy/", request.path):
                    return True  # Проверка прав перекладывается на has_object_permission()
                if re.fullmatch(".*/*/search/", request.path):
                    return True
                return self.has_permission_to_create(request, view)
            else:
                return self.has_permission_to_update(request, view)
kind: ConfigMap
metadata:
  name: permissions
  namespace: eav