from rest_framework.permissions import BasePermission

class IsAdmin(BasePermission):
    """
    Allows access only to admin users (is_staff=True or role='ADMIN').
    """
    def has_permission(self, request, view):
        user = request.user
        role = str(getattr(user, 'role', '') or '').upper()
        return bool(user and user.is_authenticated and (user.is_staff or role == 'ADMIN'))