"""Logic for handling permission updates."""

from uuid import UUID

from flask import g
from owsresponse import response, status as ows_status

from notifications import config
from notifications.connectors import sqs
from notifications.constants import (
    brands as brand_constants,
    email as email_constants,
    tenant as tenant_constants,
)
from notifications.models import ows_users, resource
from notifications.types import TenantType


IGNORED_APPS = ('settings', 'help-center')


def permissions_updated(  # noqa: PLR0911
    identity_id: UUID,
    tenant_type: TenantType,
    tenant_uuid: UUID,
    brand: str,
    admin_identity_id: UUID | str,
) -> response.Response:
    """Send an email notifying that a permission was updated.

    Args:
        identity_id (UUID): The identity id of the user.
        tenant_type (TenantType): The type of tenant.
        tenant_uuid (UUID): The uuid of the tenant.
        brand (str): The brand of the tenant.
        admin_identity_id (UUID): The identity id of the admin that made the change.

    """
    resource_type = tenant_constants.TENANT_TYPE_TO_NEO_MAPPING[tenant_type.value]
    resource_uuid = str(tenant_uuid)

    # Fallback to default brand if the provided brand is not recognized
    if brand not in brand_constants.BRANDS:
        g.log.warning(f'{brand} is not a recognized brand. Falling back to default brand.')
        brand = brand_constants.DEFAULT_BRAND

    applications_response = ows_users.get_applications(
        identity_id, resource_type, resource_uuid, brand
    )
    if not applications_response or not applications_response.message:
        return applications_response
    applications = [app for app in applications_response.message if app['id'] not in IGNORED_APPS]
    if not applications:
        return response.create_not_found_response('No applications found.')

    admin_identity_response = ows_users.get_identity(admin_identity_id)
    if not admin_identity_response or not admin_identity_response.message:
        return admin_identity_response
    admin_identity = admin_identity_response.message

    identity_response = ows_users.get_identity(identity_id)
    if not identity_response or not identity_response.message:
        return identity_response
    identity = identity_response.message

    resource_response = resource.get_resource_name(resource_type, resource_uuid)
    if not resource_response or not resource_response.message:
        return resource_response
    resource_name = resource_response.message

    organization_response = ows_users.get_organization_info(
        brand_constants.BRAND_TO_ORGANIZATION[brand]
    )
    if not organization_response or not organization_response.message:
        return organization_response
    org_info = organization_response.message

    message = {
        'type': email_constants.NOTIFICATIONS_DELIVERY_MESSAGE_TYPE_GENERAL,
        'subject': 'Update: Your access for {tenant_name}',
        'subject_variables': {
            'tenant_name': resource_name,
        },
        'to': [identity['email']],
        'template': 'branded_user_permissions_updated',
        'lang': identity['localization'],
        'sender': brand_constants.BRAND_SENDER_MAP[brand],
        'user_id': str(identity_id),
        'variables': {
            'default_brand': brand,
            'applications': applications,
            'tenant_name': resource_name,
            'admin_identity': admin_identity,
            'brand_info': org_info,
        },
    }

    sqs.send_messages(config.NOTIFICATIONS_DELIVERY_URL, [message])

    return response.Response(status=ows_status.NO_CONTENT)