Artist Role

class User(Base):
    role = Column(String(16), nullable=False)  # Must be "artist"
    artist_id = Column(Integer, ForeignKey("artists.id"), nullable=True)  # REQUIRED

if policy == "own":
    # Only allow if user owns the resource
    return role == "artist" and owner_id is not None and user_artist_id == owner_id

("agenda", "view"):     {"artist": "allow"}  # View all appointments
("agenda", "create"):   {"artist": "own"}    # Book own appointments
("agenda", "edit"):     {"artist": "own"}    # Edit own appointments
("agenda", "cancel"):   {"artist": "own"}    # Cancel own appointments
("agenda", "complete"): {"artist": "own"}    # Mark own as completed
("agenda", "no_show"):  {"artist": "own"}    # Mark own as no-show
("agenda", "block"):    {"artist": "own"}    # Block own time
("agenda", "export"):   {"artist": "own"}    # Export own schedule

# Artist wants to block next Friday for vacation
block = {
    "artist_id": current_user.artist_id,  # Own artist ID
    "date": "2026-03-13",
    "start_time": "09:00",
    "end_time": "17:00",
    "reason": "Vacation"
}

# Permission check:
can(
    role="artist",
    resource="agenda",
    action="block",
    owner_id=block["artist_id"],        # Owner of the block
    user_artist_id=current_user.artist_id  # Current user's artist ID
)
# Returns True because owner_id == user_artist_id

# Appointment belongs to artist_id = 5
# Current user has artist_id = 3

can(
    role="artist",
    resource="agenda",
    action="edit",
    owner_id=5,              # Appointment owner
    user_artist_id=3         # Current user
)
# Returns False because 5 != 3

("clients", "view"):    {"artist": "allow"}  # View all clients
("clients", "create"):  {"artist": "allow"}  # Create new clients
("clients", "edit"):    {"artist": "deny"}   # Cannot edit client info
("clients", "delete"):  {"artist": "deny"}   # Cannot delete clients
("clients", "consent"): {"artist": "own"}    # Manage consent for own appointments
("clients", "notes"):   {"artist": "own"}    # Edit notes for own appointments
("clients", "export"):  {"artist": "deny"}   # Cannot export client data

# Artist completed a session and wants to add notes
appointment = get_appointment(123)
# appointment.artist_id = 3 (assigned to this artist)
# current_user.artist_id = 3

can(
    role="artist",
    resource="clients",
    action="notes",
    owner_id=appointment.artist_id,      # Appointment owner
    user_artist_id=current_user.artist_id
)
# Returns True - can add notes to own appointment

add_note(
    client_id=appointment.client_id,
    appointment_id=appointment.id,
    note="First session completed. Good pain tolerance. Planning color for next session."
)

("portfolio", "view"):   {"artist": "allow"}  # View all portfolios
("portfolio", "edit"):   {"artist": "own"}    # Edit own portfolio
("portfolio", "upload"): {"artist": "own"}    # Upload to own portfolio

("reports", "view"):        {"artist": "own"}   # View own reports
("reports", "export"):      {"artist": "deny"}  # Cannot export
("reports", "view_tx"):     {"artist": "own"}   # View own transactions
("reports", "refund_void"): {"artist": "deny"}  # Cannot process refunds
("reports", "cash_close"):  {"artist": "deny"}  # Cannot close cash

# Artist wants to see this month's earnings
report = generate_report(
    artist_id=current_user.artist_id,
    start_date="2026-03-01",
    end_date="2026-03-31"
)

# Permission check:
can(
    role="artist",
    resource="reports",
    action="view",
    owner_id=report.artist_id,           # Report owner
    user_artist_id=current_user.artist_id
)
# Returns True - can view own reports

("staff", "view"):            {"artist": "allow"}  # View all staff
("staff", "manage_users"):    {"artist": "deny"}   # Cannot manage users
("staff", "toggle_active"):   {"artist": "deny"}   # Cannot disable accounts

("inventory", "view"):        {"artist": "allow"}  # View inventory
("inventory", "create_item"): {"artist": "deny"}   # Cannot create items
("inventory", "edit_item"):   {"artist": "deny"}   # Cannot edit items
("inventory", "stock_in"):    {"artist": "deny"}   # Cannot receive stock
("inventory", "stock_adj"):   {"artist": "deny"}   # Cannot adjust quantities
("inventory", "cycle_count"): {"artist": "deny"}   # Cannot do counts
("inventory", "export"):      {"artist": "deny"}   # Cannot export

("security", "settings"):    {"artist": "deny"}  # Cannot access settings
("security", "audit"):       {"artist": "deny"}  # Cannot view audit logs
("security", "backup"):      {"artist": "deny"}  # Cannot manage backups
("security", "rotate_code"): {"artist": "deny"}  # Cannot change master code

def can(
    role: str,
    resource: str,
    action: str,
    *,
    owner_id: Optional[int] = None,         # Resource owner's artist_id
    user_artist_id: Optional[int] = None,   # Current user's artist_id
    user_id: Optional[int] = None,
) -> bool:
    policy = _policy_for(role, resource, action)
    
    if policy == "own":
        # Only allow if:
        # 1. User role is "artist"
        # 2. owner_id is provided (resource has an owner)
        # 3. User's artist_id matches owner_id
        return role == "artist" and owner_id is not None and user_artist_id == owner_id