"""Shared validation logic."""

from flask import g
from oto import status as http_status
from oto.adaptors.flask import flaskify
from owsrequest import flask_request
from owsrequest.constants import headers as owsrequest_headers
from owsresponse import response

from timed_release.constants import error
from timed_release.utils.handler_utils import is_jwt_identity_authorized


def validate_profile_access(request):
    """
    Validate if requesting user has correct profile access.

    Args:
        request (flask.request): request
    Returns:
        bool: False if does not have access
    """
    profile_type, profile_id = flask_request.get_profile_headers(request)

    if not profile_id or not profile_type:
        return False

    return response.Response(message='ok')


def validate_request_headers(request):
    """Validate request headers and return error response if invalid.

    This function ensures that incoming requests contain valid identity
    information and profile access permissions:

    - At least one of orchard_identity_id or jwt_identity_id must be present.
      Otherwise, a BAD_REQUEST authorization error is returned.
    - Profile access must be valid, or the jwt_identity_id must be authorized.
      Otherwise, a FORBIDDEN_USER error is returned.

    Args:
        request (flask.Request): The incoming Flask request object.

    Returns:
        bool | flask.Response:
            - True if the request headers are valid.
            - Flask error response if validation fails.
    """
    orchard_identity_id = request.headers.get(
        owsrequest_headers.ORCHARD_IDENTITY_ID)
    jwt_identity_id = g.request_context.jwt_identity_id

    if not orchard_identity_id and not jwt_identity_id:
        return flaskify(response.create_error_response(
            error.ERROR_CODE_BAD_REQUEST, error.ERROR_CODE_AUTHORIZATION))

    validate_access = validate_profile_access(request)

    if not validate_access and not is_jwt_identity_authorized(jwt_identity_id):
        return flaskify(response.create_error_response(
            error.ERROR_DONT_HAVE_PERMISSIONS,
            error.ERROR_MESSAGE_FORBIDDEN_USER,
            status=http_status.FORBIDDEN))

    return response.Response(status=http_status.OK)