"""Schema for internal user lookup by email."""

from marshmallow import fields, pre_load, Schema, validates_schema, ValidationError

from users import constants


class InternalUserEmailSchema(Schema):
    """Schema for looking up an employee identity by email.

    This endpoint uses POST instead of GET to avoid exposing PII (email addresses)
    in URL paths, query strings, server logs, and browser history.

    Properties:
        email (str): Required. Email address to search for.
    """

    email = fields.Email(required=True)

    @pre_load
    def lowercase_email(self, in_data, **kwargs):
        """Convert email to lowercase and strip whitespace."""
        if in_data.get('email'):
            in_data['email'] = in_data['email'].lower().strip().replace(' ', '')
        return in_data

    @validates_schema
    def validate_email_domain(self, data, **kwargs):
        """Validate that the email domain is valid for employee identities."""
        allowed_domains = constants.ALLOWED_VENDOR_STAR_EMAIL_DOMAINS
        email_domain = data['email'].split('@')[-1]
        if email_domain not in allowed_domains:
            raise ValidationError(
                f'Email domain {email_domain} is not valid for employee identities.'
            )