"""Application.

Demo Flask service wired with MigrationAuthorizationBackend.

Every auth check always returns True to the caller, but shadows the real
PdpAuthorizationBackend and emits pp_auth.rollout.would_deny metrics to
Datadog whenever the inner backend would have denied.
"""

from flask import Flask, jsonify
from owsclient import OwsClient
from owslogger import flask_logger
from owsrequest import flask_request
from owsrequest.ows_client import correlation_id_getter, request_context_getter
from python_pdp_sdk import ForwardKwargsGetter, MigrationAuthorizationBackend, PdpAuthorizationBackend
from python_pdp_sdk.backends.authorization_backend import AuthorizationBackend
from python_pdp_sdk.connectors.ows_pdp.ows_pdp import OwsPdpClient

import config
import logging

from context import request_tags


app = Flask(config.SERVICE_NAME)

flask_logger.setup(
    app=app,
    environment=config.ENVIRONMENT,
    logger_name=config.LOGGER_NAME,
    logger_level=config.LOGGER_LEVEL,
    service_name=config.SERVICE_NAME,
    service_version=config.SERVICE_VERSION,
    exclude_paths=[config.HEALTH_CHECK],
)

flask_request.setup(
    app,
    config.ENVIRONMENT,
    add_request_context=True,
    exclude_paths=[config.HEALTH_CHECK],
)

logging.basicConfig(level=logging.INFO)

def setup_ows_client() -> OwsClient:
    """Create and return a configured OwsClient instance."""
    return OwsClient(
        config.ENVIRONMENT,
        config.SERVICE_NAME,
        correlation_id_getter=correlation_id_getter,
        request_context_getter=request_context_getter,
    )


def setup_authorization_backend(ows_client: OwsClient) -> AuthorizationBackend:
    """Create and return a MigrationAuthorizationBackend wrapping PdpAuthorizationBackend."""
    pdp_backend = PdpAuthorizationBackend(OwsPdpClient(ows_client))
    return MigrationAuthorizationBackend(
        inner_backend=pdp_backend,
        service_name=config.SERVICE_NAME,
        environment=config.DD_ENV,
        dd_api_key=config.DD_API_KEY,
        extra_tags_getter=request_tags,
    )


ows_client: OwsClient = setup_ows_client()
authorization_backend: AuthorizationBackend = setup_authorization_backend(ows_client)

DEFAULT_TENANT = {"tenant_uuid": config.TENANT_UUID, "tenant_type": config.TENANT_TYPE}


def _auth_check(action: str, resource_id: int | str, resource_type: str) -> bool:
    return authorization_backend.is_authorized(
        action=action,
        resource_id=resource_id,
        resource_type=resource_type,
        resource_getter=ForwardKwargsGetter(),
        tenant=DEFAULT_TENANT,
    )


@app.route(config.HEALTH_CHECK)
def health():
    return jsonify({"status": "ok"})


@app.route("/catalog/<int:catalog_id>")
def get_catalog(catalog_id: int):
    authorized = _auth_check("read", catalog_id, "catalog")
    return jsonify({"catalog_id": catalog_id, "authorized": authorized})


@app.route("/catalog/")
def list_catalogs():
    authorized = _auth_check("list", "all", "catalog")
    return jsonify({"authorized": authorized})


@app.route("/content/<int:content_id>")
def get_content(content_id: int):
    authorized = _auth_check("read", content_id, "content")
    return jsonify({"content_id": content_id, "authorized": authorized})


@app.route("/release/<int:release_id>")
def get_release(release_id: int):
    authorized = _auth_check("read", release_id, "release")
    return jsonify({"release_id": release_id, "authorized": authorized})


@app.route("/release/<int:release_id>", methods=["DELETE"])
def delete_release(release_id: int):
    authorized = _auth_check("delete", release_id, "release")
    return jsonify({"release_id": release_id, "authorized": authorized})


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000)