from rest_framework.permissions import BasePermission


class CanManageMembers(BasePermission):
    """Only authenticated gym administrators and staff can manage members."""

    message = 'شما اجازه مدیریت اعضای باشگاه را ندارید.'

    def has_permission(self, request, view):
        user = request.user
        return bool(
            user
            and user.is_authenticated
            and user.is_active
            and getattr(user, 'role', None) in ('admin', 'staff')
        )