from flask import g
from owsrequest import flask_request, request

from account import config
from account.api import ows_client
from account.constants import error, service
from account.logic.resource_getters.attributes import Tenant
from account.utils.exception import ExceptionDictOwsResponse


def check_tenant_admin_access(tenants: list[Tenant]) -> list:
    """
    Check if the user has admin access to the given tenants.

    Raises an exception if the user does not have access.

    Args:
        tenants (list[Tenant]): A list of Tenant objects to check access for.

    Returns:
        list: A list of accessible tenants if the user has access,
        or a response object if an error occurred.

    """
    headers = {
        'content-type': 'application/json',
    }
    if config.ENVIRONMENT == config.DEV_ENVIRONMENT:
        headers['authorization'] = g.request_context.authorization

    res = request.process(
        application=config.SERVICE_NAME,
        environment=config.ENVIRONMENT,
        method='POST',
        path='/v2/identity/self/tenant-access',
        service_name=service.OWS_PERMISSIONS,
        correlation_id=flask_request.next_correlation_id(),
        authorization_header=g.request_context.authorization,
        uwsgi_cache_enabled=True,
        json={
            'tenants': [
                {'tenant_uuid': t.tenant_uuid, 'tenant_type': t.tenant_type.value} for t in tenants
            ]
        },
        headers=headers,
    )

    if res.status_code == 200:
        tenants_data = res.json().get('tenants', [])
        return tenants_data

    if res.status_code in [401, 403]:
        raise ExceptionDictOwsResponse(
            code=error.ERROR_CODE_AUTHORIZATION,
            message=error.ERROR_MESSAGE_UNAUTHORIZED_TENANT_ACCESS,
            status=res.status_code,
        )

    raise ExceptionDictOwsResponse(
        code=error.ERROR_CODE_OWS_PERMISSIONS_REQUEST,
        message=res.text,
        status=res.status_code,
    )


def get_vendor_access() -> list[dict]:
    """
    Get list of vendors a user has access to.

    Returns:
        list: A list of vendors that the user has access to.
    """
    result = ows_client.get(
        service.OWS_PERMISSIONS,
        '/v2/profile/self/vendors/direct-access',
        headers={
            'Orchard-Identity-Id': g.request_context.identity_id,
            'Orchard-Profile-Type': g.request_context.profile_type,
            'Orchard-Profile-Id': g.request_context.profile_id,
        },
    )

    if result.status_code != 200:
        raise ExceptionDictOwsResponse(
            status=result.status_code,
            code=error.ERROR_CODE_OWS_PERMISSIONS_REQUEST,
            message=result.json(),
        )

    data = result.json()
    return data.get('vendors', [])


def get_profile_has_all_label_access() -> bool:
    """
    Check if the user's profile has access to all labels.

    Returns:
        bool: True if the profile has access to all labels, False otherwise.
    """
    result = ows_client.get(
        service.OWS_PERMISSIONS,
        '/v2/profile/self/all-label-access',
        headers={
            'Orchard-Identity-Id': g.request_context.identity_id,
            'Orchard-Profile-Type': g.request_context.profile_type,
            'Orchard-Profile-Id': g.request_context.profile_id,
        },
    )

    if result.status_code != 200:
        raise ExceptionDictOwsResponse(
            status=result.status_code,
            code=error.ERROR_CODE_OWS_PERMISSIONS_REQUEST,
            message=result.json(),
        )

    data = result.json()
    return data.get('has_access')