"""
control/panel/decorators.py
----------------------------
Access-control decorator for the superadmin control panel (MT-4).
"""

from functools import wraps
from flask import session, redirect, url_for, request, flash

from control.base import control_session
from control.models import Superadmin


def superadmin_required(f):
    """Redirect to /login if the session has no valid superadmin."""
    @wraps(f)
    def decorated(*args, **kwargs):
        sa_id = session.get('sa_id')
        if not sa_id:
            flash('Please log in.', 'warning')
            return redirect(url_for('auth.login', next=request.path))
        # Re-validate: account might have been deactivated since login.
        with control_session() as s:
            sa = s.get(Superadmin, sa_id)
            if sa is None or not sa.active:
                session.clear()
                flash('Your superadmin account is no longer active.', 'danger')
                return redirect(url_for('auth.login'))
        return f(*args, **kwargs)
    return decorated