#!/usr/bin/env python3
"""
Script to grant specific users access to Snowflake objects through Sigma
"""

import sys
import argparse
from sigma_api_client import SigmaAPIClient
from snowflake_object_manager import SnowflakeObjectManager
from user_management import PermissionType
from config import ConfigManager

def grant_table_access(user_email: str, database: str, schema: str, table: str, permission: str = "view"):
    """
    Grant a user access to a specific Snowflake table
    
    Args:
        user_email: Email of the user to grant access
        database: Database name (e.g., PROD)
        schema: Schema name (e.g., FACTS) 
        table: Table name (e.g., FACT_ANALYTICS)
        permission: Permission level (view, explore, edit)
    """
    try:
        # Load configuration
        config_manager = ConfigManager()
        sigma_config = config_manager.get_sigma_config()
        
        # Initialize API client and manager
        api_client = SigmaAPIClient(sigma_config)
        snowflake_manager = SnowflakeObjectManager(api_client)
        
        print(f"Granting {permission} access to {database}.{schema}.{table}")
        print(f"User: {user_email}")
        print("=" * 60)
        
        # Convert permission string to enum
        permission_type = PermissionType.VIEW
        if permission.lower() == "explore":
            permission_type = PermissionType.EXPLORE
        elif permission.lower() == "edit":
            permission_type = PermissionType.EDIT
        
        # Grant access
        result = snowflake_manager.grant_table_access(
            user_email=user_email,
            database_name=database,
            schema_name=schema,
            table_name=table,
            permission=permission_type
        )
        
        if result.get('success'):
            print(f"✅ Successfully granted access!")
            print(f"   Object: {result['object']}")
            print(f"   Dataset ID: {result['dataset_id']}")
            if 'grant' in result:
                grant_info = result['grant']
                print(f"   Grant ID: {grant_info.get('grantId', 'N/A')}")
        else:
            print(f"❌ Failed to grant access:")
            print(f"   Error: {result.get('error', 'Unknown error')}")
            return False
            
    except Exception as e:
        print(f"❌ Error: {e}")
        return False
    
    return True

def grant_schema_access(user_email: str, database: str, schema: str, permission: str = "view"):
    """
    Grant a user access to all tables in a Snowflake schema
    """
    try:
        config_manager = ConfigManager()
        sigma_config = config_manager.get_sigma_config()
        api_client = SigmaAPIClient(sigma_config)
        snowflake_manager = SnowflakeObjectManager(api_client)
        
        print(f"Granting {permission} access to all tables in {database}.{schema}")
        print(f"User: {user_email}")
        print("=" * 60)
        
        permission_type = PermissionType.VIEW
        if permission.lower() == "explore":
            permission_type = PermissionType.EXPLORE
        elif permission.lower() == "edit":
            permission_type = PermissionType.EDIT
        
        results = snowflake_manager.grant_schema_access(
            user_email=user_email,
            database_name=database,
            schema_name=schema,
            permission=permission_type
        )
        
        success_count = 0
        for result in results:
            if result.get('success'):
                print(f"✅ {result['object']}")
                success_count += 1
            else:
                print(f"❌ {result['object']}: {result.get('error', 'Unknown error')}")
        
        print(f"\nSummary: {success_count}/{len(results)} objects granted access successfully")
        return success_count > 0
        
    except Exception as e:
        print(f"❌ Error: {e}")
        return False

def grant_database_access(user_email: str, database: str, permission: str = "view"):
    """
    Grant a user access to all objects in a Snowflake database
    """
    try:
        config_manager = ConfigManager()
        sigma_config = config_manager.get_sigma_config()
        api_client = SigmaAPIClient(sigma_config)
        snowflake_manager = SnowflakeObjectManager(api_client)
        
        print(f"Granting {permission} access to all objects in {database}")
        print(f"User: {user_email}")
        print("=" * 60)
        
        permission_type = PermissionType.VIEW
        if permission.lower() == "explore":
            permission_type = PermissionType.EXPLORE
        elif permission.lower() == "edit":
            permission_type = PermissionType.EDIT
        
        results = snowflake_manager.grant_database_access(
            user_email=user_email,
            database_name=database,
            permission=permission_type
        )
        
        success_count = 0
        for result in results:
            if result.get('success'):
                print(f"✅ {result['object']}")
                success_count += 1
            else:
                print(f"❌ {result['object']}: {result.get('error', 'Unknown error')}")
        
        print(f"\nSummary: {success_count}/{len(results)} objects granted access successfully")
        return success_count > 0
        
    except Exception as e:
        print(f"❌ Error: {e}")
        return False

def main():
    parser = argparse.ArgumentParser(
        description="Grant Sigma users access to Snowflake objects",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
  # Grant table access
  python grant_user_access.py table user@company.com PROD FACTS FACT_ANALYTICS
  python grant_user_access.py table user@company.com PROD FACTS FACT_ANALYTICS --permission explore
  
  # Grant schema access  
  python grant_user_access.py schema user@company.com PROD FACTS
  
  # Grant database access
  python grant_user_access.py database user@company.com PROD
        """
    )
    
    parser.add_argument("type", choices=["table", "schema", "database"], 
                       help="Type of object to grant access to")
    parser.add_argument("user_email", help="Email of the user to grant access")
    parser.add_argument("database", help="Database name (e.g., PROD)")
    parser.add_argument("schema", nargs="?", help="Schema name (required for table/schema)")
    parser.add_argument("table", nargs="?", help="Table name (required for table)")
    parser.add_argument("--permission", "-p", choices=["view", "explore", "edit"], 
                       default="view", help="Permission level (default: view)")
    
    args = parser.parse_args()
    
    # Validate arguments
    if args.type == "table" and (not args.schema or not args.table):
        print("❌ Error: Table access requires both schema and table names")
        sys.exit(1)
    
    if args.type == "schema" and not args.schema:
        print("❌ Error: Schema access requires schema name")
        sys.exit(1)
    
    # Execute based on type
    success = False
    if args.type == "table":
        success = grant_table_access(args.user_email, args.database, args.schema, args.table, args.permission)
    elif args.type == "schema":
        success = grant_schema_access(args.user_email, args.database, args.schema, args.permission)
    elif args.type == "database":
        success = grant_database_access(args.user_email, args.database, args.permission)
    
    if success:
        print("\n🎉 Access granted successfully!")
        sys.exit(0)
    else:
        print("\n💥 Failed to grant access")
        sys.exit(1)

if __name__ == "__main__":
    main()