"""Authorization utilities."""

import uuid

import ddtrace
from flask import g
from python_pdp_sdk.resource_getters import base

from permissions import config
from permissions.constants import error


@ddtrace.tracer.wrap()
def pdp_authorize_manage_employee() -> bool:
    """Authorize the manage_employee action."""
    authorized = config.pdp_authorization_backend.is_authorized(
        action='manage_employee',
        resource_id=0,
        resource_type='identity',
        resource_getter=base.ForwardKwargsGetter(),
        # This kwarg is unused--it's here just to pass schema validation
        identity_uuid=str(uuid.uuid4()),
    )
    if not authorized:
        g.log.warn(
            error.ERROR_CODE_AUTHORIZATION,
            resources={
                'identity_id': g.request_context.jwt_identity_id,
                'resource_id': 0,
                'resource_type': 'identity',
                'auth_response': authorized,
            },
        )
        return False
    return True