from fastapi import Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession

from app.database import get_postgres_session
from app.models import Account
from app.routers.auth import get_current_account
from app.services.domain_provisioning import account_is_domain_owner


async def require_domain_owner(
    account: Account = Depends(get_current_account),
    session: AsyncSession = Depends(get_postgres_session),
) -> Account:
    if account.account_type != "company" or not account.company_domain:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Company accounts only.",
        )
    if not await account_is_domain_owner(session, account.id, account.company_domain):
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Only the domain owner can manage administrators.",
        )
    return account