from functools import wraps
from flask import g, redirect, url_for, abort, flash
from flask_login import current_user


def role_required(*roles):
    """Decorator to require specific roles and set tenant context."""
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            if not current_user.is_authenticated:
                return redirect(url_for('auth.login'))
            if current_user.role not in roles:
                abort(403)
            if current_user.role != 'superadmin':
                g.school_id = current_user.school_id
                if current_user.school is None:
                    abort(403)
                if current_user.school.status != 'approved':
                    return redirect(url_for('auth.pending_approval'))
            return f(*args, **kwargs)
        return decorated_function
    return decorator


def tenant_query(model):
    """Filter query by current tenant's school_id."""
    return model.query.filter_by(school_id=g.school_id)


def validate_tenant_resource(resource):
    """Validate that a resource belongs to the current tenant."""
    if resource is None:
        abort(404)
    if hasattr(resource, 'school_id') and resource.school_id != g.school_id:
        abort(403)
    return resource