"""RBAC helper functions for checking client/team access."""
import uuid

from fastapi import HTTPException
from sqlalchemy.ext.asyncio import AsyncSession

from models.sql.user import UserModel
from services.access_service import get_accessible_client_ids


async def check_client_access(
    user: UserModel, client_id: uuid.UUID, session: AsyncSession
) -> None:
    """Raise 403 if user cannot access the given client."""
    if user.role == "super_admin":
        return
    accessible = await get_accessible_client_ids(user, session)
    if client_id not in accessible:
        raise HTTPException(status_code=403, detail="Access denied to this client")


async def check_team_admin(
    user: UserModel, client_id: uuid.UUID, session: AsyncSession
) -> None:
    """Raise 403 if user is not an admin for the given client's scope."""
    if user.role == "super_admin":
        return
    if user.role != "client_admin":
        raise HTTPException(status_code=403, detail="Admin access required")
    accessible = await get_accessible_client_ids(user, session)
    if client_id not in accessible:
        raise HTTPException(status_code=403, detail="Access denied to this client")
