"""Logic around vendor star authorizations."""

from __future__ import annotations

from typing import Any

from permissions.constants.constants import VENDOR_STAR_UUID
from permissions.constants.vendor_star import ALLOWED_VENDOR_STAR_EMAIL_DOMAINS


def is_allowed_to_receive_vendor_star(identity_email: str) -> bool:
    """Return True if the identity is allowed to receive vendor star access."""
    return _is_in_allowed_by_email_domain(identity_email)


def _is_in_allowed_by_email_domain(identity_email: str) -> bool:
    """Check identity_by_email_domain."""
    email_domain = identity_email[identity_email.rfind('@') + 1 :]
    return email_domain.lower() in ALLOWED_VENDOR_STAR_EMAIL_DOMAINS


def resource_access_contains_vendor_star(
    resource_access: list[dict[str, Any]],
) -> bool:
    """Return True if the resource access contains the vendor star resource."""
    if not resource_access:
        raise Exception('no empty lists allowed')

    for resource in resource_access:
        is_vendor_star_resource = is_resource_vendor_star(resource)
        if is_vendor_star_resource:
            return True
    return False


def is_resource_vendor_star(resource: dict[str, Any]) -> bool:
    """Return True if the resource is for vendor star.

    Handles dictionaries matching:
        - ResourceSchema
        - SettingsResourceSchema
        - SettingsResourcesSchema
    """
    resource_uuid = resource.get('resource_uuid')
    resource_id = resource.get('resource_id')
    uuid = resource.get('uuid')

    possible_resource_identifiers = [
        bool(resource_uuid),
        bool(resource_id),
        bool(uuid),
    ]
    if sum(possible_resource_identifiers) != 1:
        raise Exception('Exactly one should be passed')

    resource_identifier = resource_uuid or resource_id or uuid

    if resource_identifier in [
        '*',
        VENDOR_STAR_UUID,
    ]:
        return True
    return False