"""Avoid using old terraform module versions that are non Checkov compliant."""


from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.terraform.checks.module.base_module_check import BaseModuleCheck

import semver
import re

import tools


class NonCompliantModules(BaseModuleCheck):
    def __init__(self):
        name = 'Avoid using old terraform module versions that are non Checkov compliant'
        id = 'ORCD_AWS_2'
        categories = [CheckCategories.GENERAL_SECURITY]
        guideline = 'https://www.notion.so/Checkov-guide-e5c30d67d35248ebbb0806df59775e0e#abec314942d149e4a13d9fc4c05b9b32'
        super().__init__(name=name, id=id, categories=categories,
                         guideline=guideline)

    def scan_module_conf(self, conf):
        source = tools.flatten(conf.get('source'))

        match = re.search(r'(?:git@|https://)github\.com[:/]'
                          r'([\w\/\-\.]+?)(\.git)?(//)?[/\w]*?\?ref=([\w\-\.]+)', source)
        if not match:
            return CheckResult.PASSED

        repo = match.group(1)
        version = match.group(4)

        # Skip non-compatible versioning and non-semantic refs (branch name).
        try:
            semver.parse(version)
        except ValueError:
            return CheckResult.PASSED

        compliant_modules = {
            'theorchard/terraform-airflow': ['>=1.0.2'],
            'theorchard/terraform-aws-waf': ['>=1.5.0'],
            'theorchard/terraform-datadog': ['>=6.10.7'],
            'theorchard/terraform-default-tags': ['>=2.0.0'],
            'theorchard/terraform-dev-box': ['>=2.1.0'],
            'theorchard/terraform-dynamodb': ['>=3.3.1'],
            'theorchard/terraform-ecr': ['>=1.8.0'],
            'theorchard/terraform-efs': ['>=1.3.0'],
            'theorchard/terraform-elasticache': ['>=2.3.2'],
            'theorchard/terraform-elasticsearch': ['>=1.7.5,<2.0.0','>=2.4.6'],
            'theorchard/terraform-emr': ['>=1.3.1'],
            'theorchard/terraform-fargate': ['>=5.5.1'],
            'theorchard/terraform-github': ['>=4.0.0'],
            'theorchard/terraform-lambda': ['>=3.1.4'],
            'theorchard/terraform-managed-kafka': ['>=2.2.1'],
            'theorchard/terraform-rds': ['>=2.0.3'],
            'theorchard/terraform-s3': ['>=3.11.0'],
            'theorchard/terraform-secrets-manager': ['>=1.5.1'],
            'theorchard/terraform-sentry': ['>=4.1.2'],
            'theorchard/terraform-spa': ['>=1.4.0'],
        }

        for module, version_list in compliant_modules.items():
            if repo != module:
                continue

            for version_spec in version_list:
                version_matched = True
                for version_spec_rule in version_spec.split(','):
                    if not semver.match(version, version_spec_rule):
                        version_matched = False
                if version_matched:
                    return CheckResult.PASSED

            return CheckResult.FAILED

        return CheckResult.PASSED


check = NonCompliantModules()