from oto import response
from pydantic import UUID4

from product_staging.connectors import ows_permissions

# All vendors ID
ALL_VENDORS_ID = "*"

RESOURCE_TYPE_VENDOR = "Vendor"
RESOURCE_TYPE_SUBACCOUNT = "Subaccount"


def check_profile_access(
    identity_id: UUID4,
    profile_id: int,
    profile_type: str,
    vendor_id: int | None,
    subaccount_id: int | None = None,
) -> response.Response:
    """Check if profile has access to any of vendor or subaccount (if defined).
    Args:
        profile_id (int): Profile id to verify access for.
        profile_type (str): Profile type to verify access for.
        vendor_id (int): Vendor id to verify access to.
        subaccount_id (int): Subaccount id to verify access to.
        If passed it checks if profile has access to any of the subaccount or vendor

    Returns:
        Response: Response 200 if the check has passed, 403 - failed.
    """
    if ows_permissions.has_all_access(
        identity_id=identity_id, profile_id=profile_id, profile_type=profile_type
    ):
        return response.Response(status=200)

    resources_response = ows_permissions.get_profile_resources(
        profile_id, profile_type, resource_type=ows_permissions.ResourceType.LABEL
    )
    if not resources_response or resources_response.message is None:
        return resources_response

    resources = resources_response.message.get("items", [])
    for resource in resources:
        _resource_id = resource.get("id")
        _resource_type = resource.get("type")
        if (
            (
                (vendor_id and _resource_id == vendor_id)
                or _resource_id == ALL_VENDORS_ID
            )
            and _resource_type == RESOURCE_TYPE_VENDOR
        ) or (
            subaccount_id
            and _resource_id == subaccount_id
            and _resource_type == RESOURCE_TYPE_SUBACCOUNT
        ):
            return response.Response(status=200)

    return response.create_error_response(
        code="authorization_error",
        message="Profile has no access to the requested resource",
        status=403,
    )