from typing import Optional, List
from pydantic import BaseModel, Field

class UserContext(BaseModel):
    user_id: str = "USR-001"
    account_id: Optional[str] = "ACCT-001"  # Target customer account ID if customer
    is_internal: bool = False               # False = Customer Facing, True = Internal Staff
    role: str = "customer"                  # "customer", "support_agent", "operations_lead", "admin"
    user_name: str = "Northstar User"

    def can_access_account(self, target_account_id: Optional[str]) -> bool:
        """
        Data-layer security check.
        Internal users can access any account data.
        Customer users can ONLY access data belonging to their own account_id.
        """
        if self.is_internal:
            return True
        if not target_account_id:
            return True  # Public general documents
        return self.account_id == target_account_id

    def can_access_document(self, doc_filename: str, doc_account_id: Optional[str]) -> bool:
        """
        Document-layer security check.
        Customer agreements are restricted to that account only.
        """
        if self.is_internal:
            return True
        if doc_account_id:
            return self.account_id == doc_account_id
        return True

    def can_perform_action(self, action_name: str) -> bool:
        """
        Action authorization check.
        """
        if not self.is_internal and action_name in ["escalate_ticket", "update_ticket", "create_followup_task", "approve_service_credit"]:
            # Customers can request escalation for their own tickets, but internal actions are role-checked
            return True
        return True