import re
from django.shortcuts import redirect
from django.conf import settings


class RBACMiddleware:
    ROLE_ROUTES = {
        "admin": [r"^/admin/", r"^/ops/", r"^/portal/"],
        "ops": [r"^/ops/"],
        "buyer": [r"^/portal/"],
    }

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        if request.user.is_authenticated and not request.user.is_staff:
            path = request.path_info
            user_role = getattr(request.user, "role", None)
            for role, patterns in self.ROLE_ROUTES.items():
                for pattern in patterns:
                    if re.match(pattern, path) and user_role != role and not request.user.is_superuser:
                        return redirect(settings.LOGIN_REDIRECT_URL)
        return self.get_response(request)