"""平台级权限类。团队级权限仍走 apps.common.api.can_manage_team(owner/admin)。

平台超管(User.is_platform_admin)= 跨团队后台权限,凌驾团队 owner 之上;所有 /api/admin/*
端点统一挂 IsPlatformAdmin,非超管一律 403。"""

from rest_framework.permissions import BasePermission


class IsPlatformAdmin(BasePermission):
    """仅平台超级管理员放行。被停用账号即便有标志也拒绝。"""

    message = "需要平台超级管理员权限"

    def has_permission(self, request, view) -> bool:
        user = getattr(request, "user", None)
        return bool(
            user
            and user.is_authenticated
            and getattr(user, "is_platform_admin", False)
            and not getattr(user, "is_disabled", False)
        )