Multi-Tenancy Implementation

from fastapi import Depends, Header, HTTPException
from app.models.school import School

@dataclass
class AuthContext:
    user: User
    payload: TokenPayload
    membership: SchoolMembership | None = None
    school: School | None = None
    
    @property
    def school_id(self) -> uuid.UUID | None:
        return self.school.id if self.school else None

async def get_auth_context(
    x_school_id: uuid.UUID | None = Header(None, alias="X-School-Id"),
    current_user: User = Depends(get_current_user),
    db: AsyncSession = Depends(get_db),
) -> AuthContext:
    # Get user's memberships
    result = await db.execute(
        select(SchoolMembership).where(
            SchoolMembership.user_id == current_user.id,
            SchoolMembership.is_active.is_(True),
        )
    )
    memberships = list(result.scalars().all())
    
    # Resolve requested school
    if x_school_id:
        membership = next(
            (m for m in memberships if m.school_id == x_school_id),
            None
        )
        if not membership and not is_superadmin(current_user):
            raise HTTPException(403, "No access to this school")
    
    # Load school
    school = await db.get(School, x_school_id)
    
    return AuthContext(
        user=current_user,
        membership=membership,
        school=school,
        memberships=memberships,
    )

async def get_current_tenant(
    auth: AuthContext = Depends(get_auth_context),
) -> School:
    """Dependency that requires a school context."""
    if auth.school is None:
        raise HTTPException(403, "No school context")
    return auth.school

from enum import StrEnum

class Role(StrEnum):
    SUPERADMIN = "superadmin"    # Multi-tenant access
    RECTOR = "rector"            # School admin
    COORDINATOR = "coordinator"  # Academic + discipline
    SECRETARY = "secretary"      # Enrollment + comms
    TEACHER = "teacher"          # Grades + attendance
    STUDENT = "student"          # Read own data
    GUARDIAN = "acudiente"       # Read child data

ROLE_PERMISSIONS: dict[Role, set[str]] = {
    Role.SUPERADMIN: {
        "read:all", "write:all", "delete:all",
        "manage:schools",  # ← Can bypass tenant checks
        "manage:users",
    },
    Role.RECTOR: {
        "read:all", "write:all", "delete:all",
        "config:institution",
        "manage:users",
    },
    Role.COORDINATOR: {
        "read:students", "read:grades",
        "write:convivencia", "write:due_process",
    },
    Role.SECRETARY: {
        "read:students", "write:enrollment",
        "write:communications",
    },
    Role.TEACHER: {
        "read:own_students", "write:grades",
        "write:attendance", "read:schedule",
    },
    Role.STUDENT: {
        "read:own_data", "read:own_grades",
    },
}

# Always filter by school_id first
result = await db.execute(
    select(Student)
    .where(Student.school_id == tenant.id)  # ← First
    .where(Student.is_active.is_(True))      # ← Then other filters
    .order_by(Student.full_name)
)