"""
utils/db.py — SQLite connection + tenant scoping helpers.

Shared by app.py and all route blueprints so every query uses the same
WAL-enabled connection settings and the same organization scoping rule.
"""

import sqlite3

from flask import session

DB_PATH = "instance/enterprise_assetqr.db"


def get_db():
    """Open a WAL-mode SQLite connection with dict-style rows."""
    db = sqlite3.connect(DB_PATH, timeout=30)
    db.row_factory = sqlite3.Row
    db.execute("PRAGMA journal_mode=WAL")
    return db


def scoped_where():
    """
    Organization scoping for every query:
    super_admin sees everything; everyone else only their own org.
    Returns (where_clause, args).
    """
    if session.get("role") == "super_admin":
        return "1=1", []
    return "org_id=?", [session.get("org_id")]