"""Autenticacao simples por usuario/senha com roles (manager / salesperson)."""
from functools import wraps
from flask import session, redirect, url_for, request

# role: "manager" ve tudo. "salesperson" ve so leads atribuidos ao seu ghl_id.
USERS = {
    "renato":   {"password": "climb2026",      "role": "manager",     "ghl_id": None},
    "monique":  {"password": "px3monique2026", "role": "salesperson", "ghl_id": "FKCKhrtdwZjHS6ISgAFF"},
    "mary":     {"password": "px3mary2026",    "role": "salesperson", "ghl_id": "n2TXqcFucc2mSfK5p0Do"},
    "vinicius": {"password": "px3lab2026",     "role": "manager",     "ghl_id": None},
    "naiane":   {"password": "px3naiane2026",  "role": "salesperson", "ghl_id": "0ZFCVED2VANUkXjfB4tL"},
}


def check_login(username: str, password: str) -> bool:
    if not username or not password:
        return False
    user_data = USERS.get(username)
    if not user_data:
        return False
    return user_data.get("password") == password


def get_user_role(username: str) -> str:
    user_data = USERS.get(username) or {}
    return user_data.get("role", "salesperson")


def get_user_ghl_id(username: str):
    user_data = USERS.get(username) or {}
    return user_data.get("ghl_id")


def login_required(view_fn):
    @wraps(view_fn)
    def wrapped(*args, **kwargs):
        if not session.get("user"):
            return redirect(url_for("login", next=request.path))
        return view_fn(*args, **kwargs)

    return wrapped