"""CMIS access-point profile primitives.

These classes model how a CMIS adapter may expose engine capabilities without
turning CMIS into a second domain model.
"""

from __future__ import annotations

from dataclasses import dataclass, field
from enum import Enum
from typing import Any

from .actors import ActorType, OperationContext
from .assets import KnowledgeAsset
from .metadata import Sensitivity
from .policy import PolicyDecision
from .primitives import compact_dict


class CMISBinding(str, Enum):
    BROWSER = "browser"
    ATOMPUB = "atompub"
    WEB_SERVICES = "web_services"


class CMISCapability(str, Enum):
    REPOSITORY = "repository"
    TYPE_DEFINITIONS = "type_definitions"
    NAVIGATION = "navigation"
    OBJECT_READ = "object_read"
    OBJECT_WRITE = "object_write"
    CONTENT_STREAM_READ = "content_stream_read"
    CONTENT_STREAM_WRITE = "content_stream_write"
    VERSIONING = "versioning"
    DISCOVERY_QUERY = "discovery_query"
    RELATIONSHIPS = "relationships"
    ACL = "acl"
    POLICY = "policy"
    CHANGE_LOG = "change_log"
    RENDITIONS = "renditions"
    RETENTION_HOLD = "retention_hold"
    BULK_UPDATE = "bulk_update"


class CMISAction(str, Enum):
    GET_REPOSITORY_INFO = "get_repository_info"
    GET_TYPE_DEFINITION = "get_type_definition"
    GET_CHILDREN = "get_children"
    GET_OBJECT = "get_object"
    GET_CONTENT_STREAM = "get_content_stream"
    QUERY = "query"
    GET_RELATIONSHIPS = "get_relationships"
    GET_CHANGE_LOG = "get_change_log"
    CREATE_DOCUMENT = "create_document"
    UPDATE_PROPERTIES = "update_properties"
    DELETE_OBJECT = "delete_object"
    SET_CONTENT_STREAM = "set_content_stream"
    APPLY_ACL = "apply_acl"
    APPLY_POLICY = "apply_policy"
    BULK_UPDATE_PROPERTIES = "bulk_update_properties"


ACTION_CAPABILITIES: dict[CMISAction, CMISCapability] = {
    CMISAction.GET_REPOSITORY_INFO: CMISCapability.REPOSITORY,
    CMISAction.GET_TYPE_DEFINITION: CMISCapability.TYPE_DEFINITIONS,
    CMISAction.GET_CHILDREN: CMISCapability.NAVIGATION,
    CMISAction.GET_OBJECT: CMISCapability.OBJECT_READ,
    CMISAction.GET_CONTENT_STREAM: CMISCapability.CONTENT_STREAM_READ,
    CMISAction.QUERY: CMISCapability.DISCOVERY_QUERY,
    CMISAction.GET_RELATIONSHIPS: CMISCapability.RELATIONSHIPS,
    CMISAction.GET_CHANGE_LOG: CMISCapability.CHANGE_LOG,
    CMISAction.CREATE_DOCUMENT: CMISCapability.OBJECT_WRITE,
    CMISAction.UPDATE_PROPERTIES: CMISCapability.OBJECT_WRITE,
    CMISAction.DELETE_OBJECT: CMISCapability.OBJECT_WRITE,
    CMISAction.SET_CONTENT_STREAM: CMISCapability.CONTENT_STREAM_WRITE,
    CMISAction.APPLY_ACL: CMISCapability.ACL,
    CMISAction.APPLY_POLICY: CMISCapability.POLICY,
    CMISAction.BULK_UPDATE_PROPERTIES: CMISCapability.BULK_UPDATE,
}
MUTATION_ACTIONS = {
    CMISAction.CREATE_DOCUMENT,
    CMISAction.UPDATE_PROPERTIES,
    CMISAction.DELETE_OBJECT,
    CMISAction.SET_CONTENT_STREAM,
    CMISAction.APPLY_ACL,
    CMISAction.APPLY_POLICY,
    CMISAction.BULK_UPDATE_PROPERTIES,
}


@dataclass(frozen=True)
class CMISAccessProfile:
    name: str
    binding: CMISBinding | str = CMISBinding.BROWSER
    capabilities: tuple[CMISCapability | str, ...] = ()
    allow_mutations: bool = False
    visible_sensitivities: tuple[Sensitivity | str, ...] = (Sensitivity.PUBLIC, Sensitivity.INTERNAL)
    denied_sensitivities: tuple[Sensitivity | str, ...] = (Sensitivity.CONFIDENTIAL, Sensitivity.RESTRICTED)
    visible_asset_types: tuple[str, ...] = ()
    visible_topics: tuple[str, ...] = ()
    visible_source_systems: tuple[str, ...] = ()
    denied_metadata: dict[str, tuple[Any, ...]] = field(default_factory=dict)
    required_actor_types: tuple[ActorType | str, ...] = ()
    metadata: dict[str, Any] = field(default_factory=dict)

    def __post_init__(self) -> None:
        object.__setattr__(self, "binding", CMISBinding(self.binding))
        object.__setattr__(
            self,
            "capabilities",
            tuple(CMISCapability(capability) for capability in self.capabilities),
        )
        object.__setattr__(
            self,
            "visible_sensitivities",
            tuple(Sensitivity(value) for value in self.visible_sensitivities),
        )
        object.__setattr__(
            self,
            "denied_sensitivities",
            tuple(Sensitivity(value) for value in self.denied_sensitivities),
        )
        object.__setattr__(
            self,
            "required_actor_types",
            tuple(ActorType(value) for value in self.required_actor_types),
        )
        object.__setattr__(
            self,
            "denied_metadata",
            {key: tuple(values) for key, values in self.denied_metadata.items()},
        )

    @classmethod
    def readonly_browser(cls) -> "CMISAccessProfile":
        return cls(
            name="readonly-browser",
            capabilities=_read_capabilities(),
            allow_mutations=False,
        )

    @classmethod
    def governed_authoring(cls) -> "CMISAccessProfile":
        return cls(
            name="governed-authoring",
            capabilities=_read_capabilities()
            + (
                CMISCapability.OBJECT_WRITE,
                CMISCapability.CONTENT_STREAM_WRITE,
            ),
            allow_mutations=True,
        )

    @classmethod
    def admin_export(cls) -> "CMISAccessProfile":
        return cls(
            name="admin-export",
            capabilities=_read_capabilities()
            + (
                CMISCapability.RENDITIONS,
                CMISCapability.RETENTION_HOLD,
            ),
            allow_mutations=False,
            visible_sensitivities=(
                Sensitivity.PUBLIC,
                Sensitivity.INTERNAL,
                Sensitivity.CONFIDENTIAL,
                Sensitivity.RESTRICTED,
            ),
            denied_sensitivities=(),
            required_actor_types=(ActorType.SERVICE_ACCOUNT,),
        )

    @classmethod
    def compat_tck(cls) -> "CMISAccessProfile":
        return cls(
            name="compat-tck",
            capabilities=_read_capabilities()
            + (
                CMISCapability.OBJECT_WRITE,
                CMISCapability.CONTENT_STREAM_WRITE,
            ),
            allow_mutations=True,
            metadata={"compatibility": "selected-opencmis-tck-browser-subset"},
        )

    def has_capability(self, capability: CMISCapability | str) -> bool:
        return CMISCapability(capability) in self.capabilities

    def allows_action(self, action: CMISAction | str) -> bool:
        cmis_action = CMISAction(action)
        capability = ACTION_CAPABILITIES[cmis_action]
        if not self.has_capability(capability):
            return False
        if cmis_action in MUTATION_ACTIONS and not self.allow_mutations:
            return False
        return True

    def decide_action(
        self,
        action: CMISAction | str,
        context: OperationContext,
        *,
        resource: str = "cmis:repository",
    ) -> PolicyDecision:
        cmis_action = CMISAction(action)
        if not self.allows_actor(context):
            return PolicyDecision.deny(
                context.actor.id,
                cmis_action.value,
                resource,
                reason="actor_type_not_allowed_for_cmis_profile",
                context={"profile": self.name},
            )
        if self.allows_action(cmis_action):
            return PolicyDecision.allow(
                context.actor.id,
                cmis_action.value,
                resource,
                context={"profile": self.name},
            )
        capability = ACTION_CAPABILITIES[cmis_action]
        reason = "cmis_mutation_not_allowed" if cmis_action in MUTATION_ACTIONS else "cmis_capability_not_supported"
        return PolicyDecision.deny(
            context.actor.id,
            cmis_action.value,
            resource,
            reason=reason,
            context={"profile": self.name, "capability": capability.value},
        )

    def allows_actor(self, context: OperationContext) -> bool:
        return not self.required_actor_types or context.actor.actor_type in self.required_actor_types

    def exposes_asset(self, asset: KnowledgeAsset, context: OperationContext) -> bool:
        return self.decide_asset_visibility(asset, context).allowed

    def decide_asset_visibility(
        self,
        asset: KnowledgeAsset,
        context: OperationContext,
    ) -> PolicyDecision:
        resource = f"asset:{asset.id}"
        if not self.allows_actor(context):
            return PolicyDecision.deny(
                context.actor.id,
                "cmis.expose_asset",
                resource,
                reason="actor_type_not_allowed_for_cmis_profile",
                context={"profile": self.name},
            )
        classification = asset.classification
        if classification.sensitivity in self.denied_sensitivities:
            return PolicyDecision.deny(
                context.actor.id,
                "cmis.expose_asset",
                resource,
                reason="cmis_sensitivity_denied",
                context={"profile": self.name, "sensitivity": _enum_value(classification.sensitivity)},
            )
        if classification.sensitivity not in self.visible_sensitivities:
            return PolicyDecision.deny(
                context.actor.id,
                "cmis.expose_asset",
                resource,
                reason="cmis_sensitivity_not_visible",
                context={"profile": self.name, "sensitivity": _enum_value(classification.sensitivity)},
            )
        if self.visible_asset_types and classification.asset_type not in self.visible_asset_types:
            return PolicyDecision.deny(
                context.actor.id,
                "cmis.expose_asset",
                resource,
                reason="cmis_asset_type_not_visible",
                context={"profile": self.name, "asset_type": classification.asset_type},
            )
        if self.visible_topics and not set(classification.topics).intersection(self.visible_topics):
            return PolicyDecision.deny(
                context.actor.id,
                "cmis.expose_asset",
                resource,
                reason="cmis_topic_not_visible",
                context={"profile": self.name, "topics": list(classification.topics)},
            )
        source_system = asset.metadata.get("source_system") or classification.metadata.get("source_system")
        if self.visible_source_systems and source_system not in self.visible_source_systems:
            return PolicyDecision.deny(
                context.actor.id,
                "cmis.expose_asset",
                resource,
                reason="cmis_source_system_not_visible",
                context={"profile": self.name, "source_system": source_system},
            )
        for key, denied_values in self.denied_metadata.items():
            value = asset.metadata.get(key, classification.metadata.get(key))
            if value in denied_values:
                return PolicyDecision.deny(
                    context.actor.id,
                    "cmis.expose_asset",
                    resource,
                    reason="cmis_metadata_denied",
                    context={"profile": self.name, "metadata_key": key},
                )
        return PolicyDecision.allow(
            context.actor.id,
            "cmis.expose_asset",
            resource,
            context={"profile": self.name},
        )

    def to_dict(self) -> dict[str, Any]:
        return compact_dict(
            {
                "name": self.name,
                "binding": self.binding.value,
                "capabilities": [capability.value for capability in self.capabilities],
                "allow_mutations": self.allow_mutations,
                "visible_sensitivities": [item.value for item in self.visible_sensitivities],
                "denied_sensitivities": [item.value for item in self.denied_sensitivities],
                "visible_asset_types": list(self.visible_asset_types),
                "visible_topics": list(self.visible_topics),
                "visible_source_systems": list(self.visible_source_systems),
                "denied_metadata": {key: list(values) for key, values in self.denied_metadata.items()},
                "required_actor_types": [item.value for item in self.required_actor_types],
                "metadata": dict(self.metadata),
            }
        )

    @classmethod
    def from_dict(cls, data: dict[str, Any]) -> "CMISAccessProfile":
        return cls(
            name=data["name"],
            binding=data.get("binding", CMISBinding.BROWSER.value),
            capabilities=tuple(data.get("capabilities", [])),
            allow_mutations=bool(data.get("allow_mutations", False)),
            visible_sensitivities=tuple(data.get("visible_sensitivities", [])),
            denied_sensitivities=tuple(data.get("denied_sensitivities", [])),
            visible_asset_types=tuple(data.get("visible_asset_types", [])),
            visible_topics=tuple(data.get("visible_topics", [])),
            visible_source_systems=tuple(data.get("visible_source_systems", [])),
            denied_metadata=dict(data.get("denied_metadata", {})),
            required_actor_types=tuple(data.get("required_actor_types", [])),
            metadata=dict(data.get("metadata", {})),
        )


@dataclass(frozen=True)
class CMISAccessPoint:
    access_point_id: str
    repository_id: str
    profile: CMISAccessProfile
    base_path: str
    root_folder_id: str = "cmis-root"
    enabled: bool = True
    metadata: dict[str, Any] = field(default_factory=dict)

    def __post_init__(self) -> None:
        normalized = "/" + self.base_path.strip("/")
        object.__setattr__(self, "base_path", normalized)

    def decide_action(
        self,
        action: CMISAction | str,
        context: OperationContext,
        *,
        resource: str | None = None,
    ) -> PolicyDecision:
        if not self.enabled:
            return PolicyDecision.deny(
                context.actor.id,
                CMISAction(action).value,
                resource or f"cmis:{self.repository_id}",
                reason="cmis_access_point_disabled",
                context={"access_point_id": self.access_point_id, "profile": self.profile.name},
            )
        return self.profile.decide_action(
            action,
            context,
            resource=resource or f"cmis:{self.repository_id}",
        )

    def exposes_asset(self, asset: KnowledgeAsset, context: OperationContext) -> bool:
        return self.enabled and self.profile.exposes_asset(asset, context)

    def to_dict(self) -> dict[str, Any]:
        return compact_dict(
            {
                "access_point_id": self.access_point_id,
                "repository_id": self.repository_id,
                "profile": self.profile.to_dict(),
                "base_path": self.base_path,
                "root_folder_id": self.root_folder_id,
                "enabled": self.enabled,
                "metadata": dict(self.metadata),
            }
        )

    @classmethod
    def from_dict(cls, data: dict[str, Any]) -> "CMISAccessPoint":
        return cls(
            access_point_id=data["access_point_id"],
            repository_id=data["repository_id"],
            profile=CMISAccessProfile.from_dict(data["profile"]),
            base_path=data["base_path"],
            root_folder_id=data.get("root_folder_id", "cmis-root"),
            enabled=bool(data.get("enabled", True)),
            metadata=dict(data.get("metadata", {})),
        )


def _read_capabilities() -> tuple[CMISCapability, ...]:
    return (
        CMISCapability.REPOSITORY,
        CMISCapability.TYPE_DEFINITIONS,
        CMISCapability.NAVIGATION,
        CMISCapability.OBJECT_READ,
        CMISCapability.CONTENT_STREAM_READ,
        CMISCapability.VERSIONING,
        CMISCapability.DISCOVERY_QUERY,
        CMISCapability.RELATIONSHIPS,
        CMISCapability.ACL,
        CMISCapability.CHANGE_LOG,
    )


def _enum_value(value: Any) -> Any:
    return getattr(value, "value", value)