"""
DRF Permission classes – migrated from app/Http/Middleware/LimitToApiUsers.php

Laravel:  if ($request->user()->getTable() === "api_users") → allow
Django:   if isinstance(request.user, ApiUser) → allow
"""

from rest_framework.permissions import BasePermission
# from app_api.models import ApiUser


# class IsApiUser(BasePermission):
#     """
#     Allows access only to authenticated ApiUser instances.
#     Migrated from LimitToApiUsers middleware.
#     Used in combination with IsAuthenticated on all API routes.
#     """

#     message = 'Zugriff verweigert. Nur API-Nutzer haben Zugriff.'

#     def has_permission(self, request, view):
#         return bool(
#             request.user and
#             request.user.is_authenticated and
#             isinstance(request.user, ApiUser)
#         )