"""Ensure Snowflake resources are only placed in prod/snowflake directory.

This policy enforces that all Snowflake provider resources must be located
in the prod/snowflake directory within the terraform-infra repository.
"""

from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck

import os
import re
from typing import Any


# Resource types excluded from placement enforcement because they may be
# legitimately used outside of prod/snowflake (e.g. alongside AWS resources).
EXCLUDED_RESOURCE_PREFIXES = (
    'snowflake_stage',
    'snowflake_storage_integration',
)


class SnowflakeResourcePlacement(BaseResourceCheck):
    def __init__(self):
        name = 'Ensure Snowflake resources are only in prod/snowflake directory'
        id = 'ORCD_SNOWFLAKE_1'
        categories = [CheckCategories.CONVENTION]
        # Use wildcard to catch all snowflake resources
        supported_resources = ['snowflake_*']
        guideline = 'https://www.notion.so/Checkov-guide-e5c30d67d35248ebbb0806df59775e0e#2ea97177520f80f8b900f434d1605f66'

        self.allowed_path_pattern = re.compile(r'(^|/)prod/snowflake(/|$)')

        super().__init__(name=name, id=id, categories=categories,
                         supported_resources=supported_resources,
                         guideline=guideline)

    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
        # Excluded resource types are allowed anywhere
        if any(self.entity_type.startswith(prefix) for prefix in EXCLUDED_RESOURCE_PREFIXES):
            return CheckResult.PASSED

        # Get the scan directory from environment variable set by scanner.py
        # This contains the relative path like "prod/snowflake/delphi/human_users"
        scan_dir = os.environ.get('CHECKOV_SCAN_DIR', '')

        # Combine with the relative file path from run()
        scanned_file = getattr(self, '_current_file_path', '')

        # Build full path: scan_dir + scanned_file (removing leading /)
        full_path = os.path.join(scan_dir, scanned_file.lstrip('/'))
        full_path = full_path.replace('\\', '/')

        if self.allowed_path_pattern.search(full_path):
            return CheckResult.PASSED

        return CheckResult.FAILED

    def run(
        self,
        scanned_file: str,
        entity_configuration: dict[str, Any],
        entity_name: str,
        entity_type: str,
        skip_info: dict[str, Any],
    ) -> dict[str, Any]:
        # Store the scanned file path and entity type so scan_resource_conf can access them
        self._current_file_path = scanned_file

        # Call the parent run method
        return super().run(
            scanned_file=scanned_file,
            entity_configuration=entity_configuration,
            entity_name=entity_name,
            entity_type=entity_type,
            skip_info=skip_info,
        )


check = SnowflakeResourcePlacement()