from typing import Any

from django.contrib.auth import get_user_model
from mcp.server.auth.middleware.auth_context import get_access_token

from apps.utils.permission import has_perm


def authenticated_user_claims() -> dict[str, Any]:
    """返回当前请求中经过 Factory JWT 校验的用户摘要。"""
    access_token = get_access_token()
    claims = access_token.claims if access_token else None
    user = claims.get("factory_user") if claims else None
    if not isinstance(user, dict):
        raise RuntimeError("当前 MCP 请求缺少有效的 Factory 用户身份")
    return user


def authenticated_factory_user():
    """加载当前 JWT 对应的 Django 用户，供权限和数据范围逻辑复用。"""
    claims = authenticated_user_claims()
    try:
        return get_user_model().objects.select_related("belong_dept").get(
            pk=claims["id"]
        )
    except (KeyError, get_user_model().DoesNotExist) as exc:
        raise RuntimeError("当前 JWT 对应的 Factory 用户不存在") from exc


def require_permission(user, permission_code: str) -> None:
    if not has_perm(user, [permission_code]):
        raise PermissionError(f"当前用户缺少权限：{permission_code}")