from django.contrib.auth.decorators import user_passes_test
from django.http import HttpResponseForbidden

ROLE_DOCTOR = "Doctor"
ROLE_NURSE = "Nurse"
ROLE_ADMIN = "Admin"

def user_has_role(user, roles):
    if not user.is_authenticated:
        return False
    if user.is_superuser:
        return True
    if user.groups.filter(name=ROLE_ADMIN).exists():
        return True
    return user.groups.filter(name__in=list(roles)).exists()

def role_required(*roles):
    def decorator(view_func):
        return user_passes_test(lambda u: user_has_role(u, roles))(view_func)
    return decorator

def require_roles_or_403(user, roles):
    if user_has_role(user, roles):
        return None
    return HttpResponseForbidden("You do not have permission to access this EMR section.")