class HasPermissionScope(permissions.BasePermission):
    """
    Checks if the authenticated staff member possesses the required permission code
    within the resolved request.tenant.
    """
    def has_permission(self, request, view):
        if not request.user or not request.user.is_authenticated:
            return False
        if request.user.is_superuser:
            return True
        membership = StaffMembership.objects.filter(
            user=request.user,
            tenant=request.tenant,
            is_active=True
        ).select_related('role').first()
        if not membership or not membership.role:
            return False
        required_perm = getattr(view, 'required_permission', None)
        return membership.role.permissions.filter(code=required_perm).exists()