from app.config import get_settings


def is_super_admin(user) -> bool:
    return any(r.name == "super_admin" for r in user.roles)


def branch_enforced() -> bool:
    return get_settings().branch_enforce


def user_branch_id(user) -> str | None:
    return getattr(user, "branch_id", None) or None


def allowed_branch_ids(user) -> list | None:
    """Return None for 'All Branches' (super_admin, or enforcement off),
    otherwise the single branch the user belongs to."""
    if not branch_enforced():
        return None
    if is_super_admin(user):
        return None
    uid = user_branch_id(user)
    return [uid] if uid else []


def scope_where(user, model) -> list | None:
    """SQLAlchemy filter for row-level branch scoping (enforcement opt-in)."""
    allowed = allowed_branch_ids(user)
    if allowed is None:
        return None
    if not allowed:
        return [model.branch_id.in_([]) or False]
    return [model.branch_id.in_(allowed)]