"""Functions to help with authorization checking."""

from typing import TYPE_CHECKING

from abacus_common_logic.connectors.ows_permissions import get_accounts_for_profile
from abacus_common_logic.utils.log import log

if TYPE_CHECKING:
    from owsclient import OwsClient

PROFILE_TYPES_TO_CHECK = [
    'ContentProfile',
    'DistributionProfile',
    'DocumentsProfile',
    'LabelProfile',
    'MoneyhubProfile',
]


def permissions_authorize_many_accounts(
    ows_client: 'OwsClient',
    profile_type: str,
    profile_id: int,
    account_ids: list[int],
    profile_types_to_check: list[str] = PROFILE_TYPES_TO_CHECK,
) -> bool:
    """Check if the requesting client is allowed to access the requested accounts.

    This will call ows-permissions to get the list of accounts the client's profile
    has access to.

    This only checks access if the request is coming from
    one of `profile_types_to_check`.

    Args:
        ows_client (OwsClient): The OwsClient instance to call ows-permissions.
        profile_type (str): The type of the requesting client's profile.
        profile_id (int): The ID of the requesting client's profile.
        account_ids (int): The IDs of the requested accounts.
        profile_types_to_check (list[str]): An optional list of profile types to check.

    Returns:
        bool: A boolean representing the authorization decision.
    """
    if profile_type not in profile_types_to_check:
        return True

    allowed_account_ids = get_accounts_for_profile(ows_client, profile_type, profile_id)

    has_access = set(account_ids).issubset(allowed_account_ids) or (
        '*' in allowed_account_ids
    )

    if not has_access:
        log(
            'warn',
            "Requesting client doesn't have access to the requested accounts",
            resources={
                'profile_type': profile_type,
                'profile_id': profile_id,
                'account_ids': account_ids,
                'allowed_account_ids': allowed_account_ids,
            },
        )

    return has_access