"""Ensure CloudFront distribution has a response headers policy attached."""


from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck

import tools


class CloudFrontResponseHeadersAttached(BaseResourceCheck):
    def __init__(self):
        name = 'Ensure CloudFront distribution has a response headers policy attached'
        id = 'ORCD_AWS_3'
        categories = [CheckCategories.NETWORKING]
        supported_resources = ['aws_cloudfront_distribution']
        guideline = 'https://www.notion.so/Checkov-guide-e5c30d67d35248ebbb0806df59775e0e#2a109a24adb44b5dbe3b74d1085c661b'
        super().__init__(name=name, id=id, categories=categories,
                         supported_resources=supported_resources,
                         guideline=guideline)

    def scan_resource_conf(self, conf):
        cache_block = tools.flatten(conf.get('default_cache_behavior'))
        if not cache_block or not isinstance(cache_block, dict):
            return CheckResult.FAILED
        policy_attribute = \
            tools.flatten(cache_block.get('response_headers_policy_id'))
        if not policy_attribute:
            return CheckResult.FAILED

        cache_block = tools.flatten(conf.get('ordered_cache_behavior'))
        if cache_block and isinstance(cache_block, dict):
            policy_attribute = \
                tools.flatten(cache_block.get('response_headers_policy_id'))
            if not policy_attribute:
                return CheckResult.FAILED

        cache_blocks = tools.flatten(conf.get('ordered_cache_behavior'))
        if cache_blocks and isinstance(cache_blocks, list):
            for cache_block in cache_blocks:
                if cache_block and isinstance(cache_block, dict):
                    policy_attribute = \
                        tools.flatten(cache_block.get(
                            'response_headers_policy_id'))
                    if not policy_attribute:
                        return CheckResult.FAILED

        return CheckResult.PASSED


check = CloudFrontResponseHeadersAttached()