from __future__ import annotations

from uuid import UUID

from fastapi import Request

from app.core.errors import AppError


def guest_project_scope(request: Request) -> UUID | None:
    principal = getattr(request.state, "auth_principal", None)
    if getattr(principal, "role", None) != "guest":
        return None
    project_id = getattr(principal, "project_id", None)
    if isinstance(project_id, UUID):
        return project_id
    raise AppError(
        code="GUEST_PROJECT_SCOPE_REQUIRED",
        message="Deze gastensessie heeft alleen toegang tot de GeoIntel-demowerkruimte.",
        status_code=403,
    )


def assert_guest_project_scope(request: Request, project_id: UUID) -> None:
    guest_project_id = guest_project_scope(request)
    if guest_project_id is not None and project_id != guest_project_id:
        raise AppError(
            code="GUEST_PROJECT_SCOPE_REQUIRED",
            message="Deze gastensessie heeft alleen toegang tot de GeoIntel-demowerkruimte.",
            status_code=403,
        )


def guest_scoped_project_filter(
    request: Request,
    requested_project_id: UUID | None,
) -> UUID | None:
    guest_project_id = guest_project_scope(request)
    if guest_project_id is None:
        return requested_project_id
    if requested_project_id is not None:
        assert_guest_project_scope(request, requested_project_id)
    return guest_project_id