from __future__ import annotations

from govoplan_core.access.db.base import AccessBase
from govoplan_core.access.db import models as access_models  # noqa: F401 - populate access metadata
from govoplan_core.core.modules import MigrationSpec, ModuleManifest, PermissionDefinition, RoleTemplate


def _permission(scope: str, label: str, description: str, category: str, level: str) -> PermissionDefinition:
    module_id, resource, action = scope.split(":", 2)
    return PermissionDefinition(
        scope=scope,
        label=label,
        description=description,
        category=category,
        level=level,  # type: ignore[arg-type]
        module_id=module_id,
        resource=resource,
        action=action,
    )


ACCESS_PERMISSIONS: tuple[PermissionDefinition, ...] = (
    _permission("access:tenant:read", "View tenants", "List and inspect tenant registry entries.", "Access", "system"),
    _permission("access:tenant:create", "Create tenants", "Create tenant registry entries.", "Access", "system"),
    _permission("access:tenant:update", "Update tenants", "Update tenant metadata and activation state.", "Access", "system"),
    _permission("access:account:read", "View accounts", "List and inspect global login accounts.", "Access", "system"),
    _permission("access:account:create", "Create accounts", "Create global login accounts.", "Access", "system"),
    _permission("access:account:update", "Update accounts", "Update or suspend global login accounts.", "Access", "system"),
    _permission("access:membership:read", "View memberships", "List tenant memberships and effective access.", "Tenant access", "tenant"),
    _permission("access:membership:create", "Create memberships", "Create tenant-local account memberships.", "Tenant access", "tenant"),
    _permission("access:membership:update", "Update memberships", "Update or suspend tenant memberships.", "Tenant access", "tenant"),
    _permission("access:group:read", "View groups", "List tenant groups and members.", "Tenant access", "tenant"),
    _permission("access:group:write", "Manage groups", "Create and update tenant groups.", "Tenant access", "tenant"),
    _permission("access:group:manage_members", "Manage group members", "Add and remove memberships from groups.", "Tenant access", "tenant"),
    _permission("access:role:read", "View roles", "Inspect tenant and system role definitions.", "Tenant access", "tenant"),
    _permission("access:role:write", "Manage roles", "Create and update assignable roles.", "Tenant access", "tenant"),
    _permission("access:role:assign", "Assign roles", "Bind roles to memberships, groups, accounts or services.", "Tenant access", "tenant"),
    _permission("access:api_key:read", "View API keys", "List API keys without revealing secrets.", "Tenant access", "tenant"),
    _permission("access:api_key:create", "Create API keys", "Create tenant API keys within delegation limits.", "Tenant access", "tenant"),
    _permission("access:api_key:revoke", "Revoke API keys", "Revoke tenant API keys.", "Tenant access", "tenant"),
    _permission("access:setting:read", "View settings", "Read access and governance settings.", "Tenant access", "tenant"),
    _permission("access:setting:write", "Manage settings", "Update access and governance settings.", "Tenant access", "tenant"),
    _permission("access:governance:read", "View governance", "Inspect managed role and group templates.", "Access", "system"),
    _permission("access:governance:write", "Manage governance", "Create and assign managed role and group templates.", "Access", "system"),
)

ACCESS_ROLE_TEMPLATES: tuple[RoleTemplate, ...] = (
    RoleTemplate(
        slug="system_owner",
        name="System owner",
        description="Protected full instance-wide administration.",
        permissions=("system:*",),
        level="system",
        managed=True,
        protected=True,
    ),
    RoleTemplate(
        slug="system_admin",
        name="System administrator",
        description="Manage tenants, accounts, settings, and governance without protected owner status.",
        permissions=(
            "access:tenant:read",
            "access:tenant:create",
            "access:tenant:update",
            "access:account:read",
            "access:account:create",
            "access:account:update",
            "access:governance:read",
            "access:governance:write",
        ),
        level="system",
        managed=True,
        protected=False,
    ),
    RoleTemplate(
        slug="tenant_owner",
        name="Tenant owner",
        description="Protected full tenant administration and module access.",
        permissions=("tenant:*",),
        level="tenant",
        managed=True,
        protected=True,
    ),
    RoleTemplate(
        slug="access_admin",
        name="Access administrator",
        description="Manage memberships, groups, roles, and API keys within delegation limits.",
        permissions=(
            "access:membership:read",
            "access:membership:create",
            "access:membership:update",
            "access:group:read",
            "access:group:write",
            "access:group:manage_members",
            "access:role:read",
            "access:role:assign",
            "access:api_key:read",
            "access:api_key:create",
            "access:api_key:revoke",
        ),
        level="tenant",
        managed=True,
        protected=False,
    ),
)

manifest = ModuleManifest(
    id="access",
    name="Access",
    version="1.0.0",
    permissions=ACCESS_PERMISSIONS,
    role_templates=ACCESS_ROLE_TEMPLATES,
    migration_spec=MigrationSpec(module_id="access", metadata=AccessBase.metadata),
)


def get_manifest() -> ModuleManifest:
    return manifest