"""Authorization utilities."""

import ddtrace
from flask import g
from python_pdp_sdk import ForwardKwargsGetter  # type: ignore

from store import config
from store.constants import error
from store.constants.authorization import AUTHORIZED_IDENTITIES


@ddtrace.tracer.wrap()  # type: ignore[attr-defined]
def pdp_authorize_resource(
    resource_id: int,
    resource_type: str,
    action: str = "view",
) -> bool:
    """Authorize a resource with empty attributes."""
    authorized = config.pdp_authorization_backend.is_authorized(
        action=action,
        resource_id=resource_id,
        resource_type=resource_type,
        resource_getter=ForwardKwargsGetter(),
    )
    if not authorized:
        g.log.warn(
            error.ERROR_MESSAGE_FORBIDDEN_USER,
            resources={
                "identity_id": g.request_context.jwt_identity_id,
                "resource_id": resource_id,
                "resource_type": resource_type,
                "auth_response": authorized,
            },
        )
        return False
    return True


def is_jwt_identity_authorized(jwt_identity_id: str) -> bool:
    """Check if the given JWT identity UUID is authorized.

    Args:
        jwt_identity_id (str): The identity UUID.
    """
    return jwt_identity_id in AUTHORIZED_IDENTITIES