o
    dBj(                     @  sF  U d Z ddlmZ ddlmZmZmZmZ ddddgdd	d
dddddddddddgddddddddddddddgddddddddgdd d!d"dd#d$dd%d&dgdd'd(d)dd*d+dd,d-dd.d/dgdd0d1d2dd3d4dd5d6dgdgZd7e	d8< d9d: eD Z
g d;g d<g d=d>Zd?e	d@< dAZddFdGZddJdKZddMdNZddOdPZddSdTZddUdVZddWdXZddYdZZdd[d\Zdd_d`ZddadbZ	cdddddeZddfdgZddhdiZddjdkZddmdnZddodpZddqdrZ	cdddsdtZddudvZ ddwdxZ!dddzd{Z"dd|d}Z#dddZ$dcS )z
Master panel staff RBAC (additive; is_master super-users keep full access).

Staff accounts: has_master_panel=1 + per-user permissions in user_master_permissions.
Customer business admins never receive master panel access.
    )annotations)AnyDictListOptionalzPanel accessmaster.panel.accesszAccess master panel)codelabel)r	   permissions
Businessesmaster.businesses.viewzView businesses overviewmaster.businesses.managez"Manage BID (logs, status, retries)master.businesses.onboardzOnboard / create businesseszmaster.businesses.deletezDelete businessesSupportmaster.support.viewzView all support ticketsmaster.support.replyzReply to ticketsmaster.support.resolvezResolve / update ticket statusmaster.support.approve_featureszApprove feature-enable requestszUsage & billingmaster.usage.viewzView usage dashboardzmaster.usage.allocatez Allocate minutes / change limitszSTT & pipelinemaster.stt.viewzView STT pipeline & statusmaster.stt.managezConfigure / start STT jobszmaster.stt.keyszUpdate API keys (sensitive)Configurationmaster.defaults.viewzView default parametersmaster.defaults.editzEdit default parametersmaster.webhooks.viewzView webhook ingest logmaster.audit.viewzView audit / activity logzUser administrationmaster.users.viewzView HQ / admin userszmaster.users.managezCreate users & assign BIDsmaster.staff.managezManage staff permissionszList[Dict[str, Any]]MASTER_PERMISSION_GROUPSc                 C  s(   h | ]}| d p
g D ]}|d qqS )r
   r   )get).0groupitem r#   6/home/aiteam/pcaa-dev/dashboard-backend/master_rbac.py	<setcomp>H   s    r%   )
r   r   r   r   r   r   r   r   r   r   )r   r   r   r   r   r   )r   r   r   r   r   r   )	developersupport
onboardingzDict[str, List[str]]STAFF_TEAM_PRESETS)r&   r'   r(   customvaluer   returnboolc                 C  s    | du p| dkpt |  dkS )NT   1strstrip)r+   r#   r#   r$   _truthyp   s    r3   userOptional[Dict[str, Any]]c                 C  s   t | pi dS )N	is_master)r3   r   r4   r#   r#   r$   is_super_mastert   s   r8   	List[str]c                 C  s6   | sg S t | rdgS | dpg }tdd |D S )N*master_permissionsc                 S  s$   h | ]}t | rt | qS r#   r0   )r    pr#   r#   r$   r%   ~   s   $ z*master_permissions_list.<locals>.<setcomp>)r8   r   sorted)r4   permsr#   r#   r$   master_permissions_listx   s   r?   c                 C  s   t | rdS t| p
i dS )NThas_master_panel)r8   r3   r   r7   r#   r#   r$   has_master_panel_flag   s   rA   
permissionr1   c                 C  sL   t | rdS t| sdS t|pd }|sdS t| }d|v r"dS ||v S )NTF r:   )r8   rA   r1   r2   r?   )r4   rB   r   r>   r#   r#   r$   has_master_permission   s   rD   c                 C  s
   t | dS Nr   )rD   r7   r#   r#   r$   can_access_master_panel   s   
rF   c                 C  s   t | rdS t| dS )zCUsed where legacy code checked is_master for support inbox actions.Tr   r8   rD   r7   r#   r#   r$   can_act_as_master_for_support   s   
rH   c                 C  s   t | pi dp	d  S )N
staff_teamrC   )r1   r   r2   lowerr7   r#   r#   r$   staff_team_value   s   rK   c                 C  &   t | rdS t| dkrdS t| dS )zFOnly support staff (or super master) may assign tickets to developers.Tr'   Fr   r8   rK   rD   r7   r#   r#   r$   can_assign_support_tickets   s
   
rN   ticketOptional[int]c              	   C  @   | pi  d}z|d urt|W S d W S  ttfy   Y d S w )Nassigned_to_user_idr   int	TypeError
ValueError)rO   rawr#   r#   r$   _ticket_assignee_user_id      rX   c              	   C  rQ   )NidrS   )r4   rW   r#   r#   r$   _staff_user_id   rY   r[   Nc                 C  sZ   t | rdS t| dkrdS t| dsdS |sdS t|}t| }|duo,|duo,||kS )zUDevelopers may update status on tickets assigned to them; super master on any ticket.Tr&   Fr   N)r8   rK   rD   rX   r[   )r4   rO   assignee_iduser_idr#   r#   r$   !can_update_assigned_ticket_status   s   
r^   c                 C  rL   )NTr'   Fr   rM   r7   r#   r#   r$   can_manage_support_email   
   
r_   c                 C  rL   )NTr'   Fr   rM   r7   r#   r#   r$   can_approve_support_features   r`   ra   c                 C  s   t | pt| S )uW   Legacy alias — support no longer resolves tickets; developers do on assigned tickets.)r^   r_   r7   r#   r#   r$   can_resolve_support_tickets   s   rb   Nonec                 C  $   ddl m} t| rd S |ddd)Nr   HTTPException  z%Only support staff can assign ticketsstatus_codedetail)fastapirf   rN   r4   rf   r#   r#   r$   "require_can_assign_support_tickets      rm   c                 C  s   t |  d S N) require_can_manage_support_emailr7   r#   r#   r$   #require_can_resolve_support_tickets   s   rq   c                 C  rd   )Nr   re   rg   z4Only support staff can manage support email settingsrh   )rk   rf   r_   rl   r#   r#   r$   rp      rn   rp   c                 C  &   ddl m} t| |rd S |ddd)Nr   re   rg   zKOnly the assigned developer (or super master) can update this ticket statusrh   )rk   rf   r^   )r4   rO   rf   r#   r#   r$   )require_can_update_assigned_ticket_status   s   
rs   c                 C  rr   )Nr   re   rg   zMaster panel permission deniedrh   )rk   rf   rD   )r4   rB   rf   r#   r#   r$   require_master_permission  s   
rt   c                 C  s   t | d d S rE   )rt   r7   r#   r#   r$   require_master_panel  s   ru   Optional[str]c                 C  s   |r	t | | dS t|  dS )zLBackward-compatible gate: super master always passes; staff need permission.N)rt   ru   )r4   rB   r#   r#   r$   require_master_access  s   rw   c                 C  s8   t | rdS g d}|D ]\}}t| |r|  S qdS )N/pca-master)
)r   rx   )r   z/pca-master/support)r   z/pca-master/onboarding)r   z/pca-master/usage)r   z/pca-master/stt)r   z/pca-master/default-parameters)r   z/pca-master/webhook-ingest-log)r   z/pca-master/audit-trail)r   z/pca-master/hq-users)r   z/pca-master/staff-accessrG   )r4   orderedpermpathr#   r#   r$   default_landing_path  s   
r|   Dict[str, Any]c                   C  s   t tttdS )N)groupspresetsteams)r   r)   listSTAFF_TEAMSr#   r#   r#   r$   permission_catalog/  s   r   )r+   r   r,   r-   )r4   r5   r,   r-   )r4   r5   r,   r9   )r4   r5   rB   r1   r,   r-   )r4   r5   r,   r1   )rO   r5   r,   rP   )r4   r5   r,   rP   ro   )r4   r5   rO   r5   r,   r-   )r4   r5   r,   rc   )r4   r5   rO   r5   r,   rc   )r4   r5   rB   r1   r,   rc   )r4   r5   rB   rv   r,   rc   )r,   r}   )%__doc__
__future__r   typingr   r   r   r   r   __annotations__MASTER_PERMISSION_CODESr)   r   r3   r8   r?   rA   rD   rF   rH   rK   rN   rX   r[   r^   r_   ra   rb   rm   rq   rp   rs   rt   ru   rw   r|   r   r#   r#   r#   r$   <module>   s    

	
;



	





	











