"""Ensure Snowflake permission-related resources are only used within approved modules.

This policy enforces that Snowflake grant, user, and role resources must be contained
within one of our terraform-snowflake modules.
"""
import os

from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck

import logging
import re
from typing import Any


class SnowflakeGrantInApprovedModule(BaseResourceCheck):
    EXEMPT_DIRECTORIES = [
        "prod/snowflake/delphi/human_users",
        "prod/snowflake/delphi/roles",
        "prod/snowflake/delphi/service_users",
        "prod/snowflake/delphidev/human_users",
        "prod/snowflake/delphidev/roles",
        "prod/snowflake/delphidev/service_users",
        # Shared databases
        "prod/snowflake/delphi/databases/ds-chartmetric",
        "prod/snowflake/delphi/databases/orchard-app-reporting-v2",
        "prod/snowflake/delphi/databases/orchard-app-reporting-v2/additional_roles",
        "prod/snowflake/delphi/databases/orchard-facts",
        "prod/snowflake/delphi/databases/orchard-fansifter",
        # External stages
        "prod/snowflake/delphi/external-stages/dev-collaborators-s3-stage",
        "prod/snowflake/delphi/external-stages/prod-business-intelligence-s3-stage",
    ]

    def __init__(self):
        name = 'Ensure Snowflake permission-related resources are only used within approved modules'
        id = 'ORCD_SNOWFLAKE_2'
        categories = [CheckCategories.CONVENTION]
        # Match all Snowflake permission-related resources
        supported_resources = [
            'snowflake_grant_*',
            'snowflake_user',
            'snowflake_user_*'
            'snowflake_*_user',
            'snowflake_role',
            'snowflake_role_*',
            'snowflake_*_role',
        ]
        guideline = 'https://www.notion.so/Checkov-guide-e5c30d67d35248ebbb0806df59775e0e'

        super().__init__(name=name, id=id, categories=categories,
                         supported_resources=supported_resources,
                         guideline=guideline)

    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
        """
        Scan the resource configuration using the graph to check parent module.
        """
        scan_dir = os.environ.get('CHECKOV_SCAN_DIR', '')
        if scan_dir in self.EXEMPT_DIRECTORIES:
            return CheckResult.SKIPPED

        resource_address = conf.get("__address__", "")

        # Extract the top-level module address
        module_match = re.match(r'module\.(?P<module_address>[^.]+)', resource_address)
        if not module_match:
            # Resource is not in a module
            return CheckResult.FAILED

        module_address = module_match.group('module_address')
        module_resource = None

        for idx, resource in self.graph.nodes():
            if resource.get("__address__", "") == module_address:
                module_resource = resource
                break

        if not module_resource:
            logging.error(f"Failed to locate module resource with address: {module_address}")
            return CheckResult.SKIPPED

        source = module_resource.get("source", "")

        if source.startswith("git@github.com:theorchard/terraform-snowflake.git"):
            return CheckResult.PASSED

        return CheckResult.FAILED


check = SnowflakeGrantInApprovedModule()