"""Private API Handlers.

This module contains the request handlers for endpoints
under the "/private" sub-root of the application.

These endpoints are designed to be **inaccessible** from external networks
(i.e., they are not proxied or exposed by the 'ows-grass' service).
They can only be called from within the trusted **private network**.

Due to this restricted access model, extensive authentication and
authorization checks are largely **skipped** within these handlers.
"""

from typing import Any

from connector_neo4j import Neo4jSession
from flask import Response as FlaskResponse, g
from owsrequest import flask_request
from owsresponse.adaptors.flask import flaskify

from notifications import config
from notifications.api import app
from notifications.logic import permissions
from notifications.utils import api_utils
from notifications.validation.schemas.permissions import PermissionsUpdatedSchema


@app.route('/private/permissions/updated', methods=['POST'])
@api_utils.jwt_check
@flask_request.request_context_from_headers()
@api_utils.validate_request_data(PermissionsUpdatedSchema())
@Neo4jSession(use_v2=True, database=config.NEO4J_DB_NAME)
def permissions_updated(validated_json: dict[str, Any]) -> FlaskResponse:
    """Send an email notifying that a permission was updated."""
    admin_identity_id: str = g.request_context.jwt_identity_id  # ensured by @api_utils.jwt_check
    return flaskify(
        permissions.permissions_updated(admin_identity_id=admin_identity_id, **validated_json)
    )