from django.contrib.auth.models import Permission
from django.db.models import F


def business_permissions_for_user(user):
    """Unscoped permission inventory, NEVER an authorization decision."""
    if not getattr(user, "is_authenticated", False) or not getattr(user, "pk", None):
        return Permission.objects.none()
    return Permission.objects.filter(
        business_roles__is_active=True,
        business_roles__user_assignments__user_id=user.pk,
        business_roles__user_assignments__user__is_active=True,
        business_roles__user_assignments__is_active=True,
        business_roles__user_assignments__organization_assignment__is_active=True,
        business_roles__user_assignments__organization_assignment__user_id=F("business_roles__user_assignments__user_id"),
    ).distinct().order_by("content_type__app_label", "codename")