"""工资操作按已绑定的账号身份授权，管理员和岗位角色不构成旁路。"""

from app.core.config import get_settings
from app.core.exceptions import ForbiddenError


def can_write_payroll(user) -> bool:
    """未绑定制作人时关闭业务写入；停用账号不能操作。"""
    maker = get_settings().payroll_maker_user_id
    return maker is not None and user is not None and user.id == maker and user.status == 1


def ensure_payroll_writer(user):
    if not can_write_payroll(user):
        raise ForbiddenError("仅指定的工资制作人可以修改业务数据")
    return user