# -*- coding: utf-8 -*-
"""领域层 · RBAC 判定规则（纯函数，不依赖 HTTP/数据库）。

四层架构：领域层定义核心业务模型与规则；接口层守卫（rbac.py 的 Depends
工厂）只负责调用这些规则并映射为 HTTP 异常，不承载判定语义。
"""
from __future__ import annotations

# 数据范围层级（越靠前权限越大）
SCOPE_ORDER = ("province", "city", "district")


def role_allowed(user: dict, *roles: str) -> bool:
    """当前用户业务角色是否 ∈ 允许角色集合。"""
    return user.get("role") in set(roles)


def sub_role_allowed(user: dict, *sub_roles: str) -> bool:
    """当前用户子角色是否 ∈ 允许子角色集合（如 op_super_admin）。"""
    return user.get("sub_role") in set(sub_roles)


def permission_granted(user: dict, perm: str) -> bool:
    """当前用户是否拥有权限码 perm。"""
    return perm in user.get("permissions", [])


def is_government(user: dict) -> bool:
    return user.get("role") == "government"


def scope_level_ok(user: dict, min_level: str | None) -> bool:
    """政务数据范围层级校验：不低于 min_level。"""
    if not user.get("region_id"):
        return False
    if not min_level or not user.get("scope_level"):
        return True
    cur = user["scope_level"]
    return cur in SCOPE_ORDER and SCOPE_ORDER.index(cur) <= SCOPE_ORDER.index(min_level)


def region_in_scope(user: dict, region_id: str | None) -> bool:
    """目标区域是否落在当前用户数据范围内。"""
    return bool(region_id) and region_id in user.get("scope_region_ids", [])