"""Ensure CloudFront response headers policy has Referrer Policy configured."""


from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck

import tools


class CloudFrontResponseHeadersReferrerPolicy(BaseResourceCheck):
    def __init__(self):
        name = 'Ensure CloudFront response headers policy has Referrer Policy configured'
        id = 'ORCD_AWS_9'
        categories = [CheckCategories.NETWORKING]
        supported_resources = ['aws_cloudfront_response_headers_policy']
        guideline = 'https://www.notion.so/Checkov-guide-e5c30d67d35248ebbb0806df59775e0e#c13f9de9cd114d40a870f5c2f2d0ff9c'
        super().__init__(name=name, id=id, categories=categories,
                         supported_resources=supported_resources,
                         guideline=guideline)

    def scan_resource_conf(self, conf):
        config_block = tools.flatten(conf.get('security_headers_config'))
        if config_block and isinstance(config_block, dict):
            referrer_policy_block = \
                tools.flatten(config_block.get('referrer_policy'))

            if (not referrer_policy_block
               or not isinstance(referrer_policy_block, dict)):
                return CheckResult.FAILED

            override_attribute = \
                tools.flatten(referrer_policy_block.get('override'))
            referrer_policy_attribute = \
                tools.flatten(referrer_policy_block.get('referrer_policy'))

            referrer_policy_allowed = [
                'no-referrer', 'no-referrer-when-downgrade', 'origin',
                'origin-when-cross-origin', 'same-origin', 'strict-origin',
                'strict-origin-when-cross-origin'
            ]

            if not (override_attribute
                    and referrer_policy_attribute in referrer_policy_allowed):
                return CheckResult.FAILED

        return CheckResult.PASSED


check = CloudFrontResponseHeadersReferrerPolicy()