"""RBAC permission system."""
from enum import Enum
from typing import Set


class Permission(str, Enum):
    """All available permissions in the system."""

    # Users
    USERS_CREATE = "users.create"
    USERS_READ = "users.read"
    USERS_UPDATE = "users.update"
    USERS_DELETE = "users.delete"
    USERS_IMPERSONATE = "users.impersonate"

    # Tenants
    TENANTS_CREATE = "tenants.create"
    TENANTS_READ = "tenants.read"
    TENANTS_UPDATE = "tenants.update"
    TENANTS_DELETE = "tenants.delete"
    TENANTS_MANAGE = "tenants.manage"

    # Roles
    ROLES_CREATE = "roles.create"
    ROLES_READ = "roles.read"
    ROLES_UPDATE = "roles.update"
    ROLES_DELETE = "roles.delete"
    ROLES_ASSIGN = "roles.assign"

    # API Keys
    API_KEYS_CREATE = "api_keys.create"
    API_KEYS_READ = "api_keys.read"
    API_KEYS_REVOKE = "api_keys.revoke"
    API_KEYS_ROTATE = "api_keys.rotate"

    # Billing
    BILLING_READ = "billing.read"
    BILLING_MANAGE = "billing.manage"
    BILLING_INVOICES = "billing.invoices"
    BILLING_SUBSCRIBE = "billing.subscribe"

    # Audit Logs
    AUDIT_READ = "audit.read"
    AUDIT_EXPORT = "audit.export"

    # Reports
    REPORTS_CREATE = "reports.create"
    REPORTS_READ = "reports.read"
    REPORTS_RUN = "reports.run"
    REPORTS_EXPORT = "reports.export"
    REPORTS_DELETE = "reports.delete"

    # Plugins
    PLUGINS_INSTALL = "plugins.install"
    PLUGINS_CONFIGURE = "plugins.configure"
    PLUGINS_UNINSTALL = "plugins.uninstall"
    PLUGINS_ENABLE = "plugins.enable"

    # Settings
    SETTINGS_READ = "settings.read"
    SETTINGS_UPDATE = "settings.update"

    # Super admin - all access
    ALL = "*"


# Predefined roles with their permissions
DEFAULT_ROLES = {
    "superadmin": [Permission.ALL],
    "admin": [
        Permission.USERS_CREATE,
        Permission.USERS_READ,
        Permission.USERS_UPDATE,
        Permission.USERS_DELETE,
        Permission.ROLES_READ,
        Permission.ROLES_ASSIGN,
        Permission.API_KEYS_CREATE,
        Permission.API_KEYS_READ,
        Permission.API_KEYS_REVOKE,
        Permission.BILLING_READ,
        Permission.BILLING_INVOICES,
        Permission.AUDIT_READ,
        Permission.AUDIT_EXPORT,
        Permission.REPORTS_CREATE,
        Permission.REPORTS_READ,
        Permission.REPORTS_RUN,
        Permission.REPORTS_EXPORT,
        Permission.PLUGINS_CONFIGURE,
        Permission.PLUGINS_ENABLE,
        Permission.SETTINGS_READ,
        Permission.SETTINGS_UPDATE,
    ],
    "editor": [
        Permission.USERS_READ,
        Permission.USERS_UPDATE,
        Permission.REPORTS_CREATE,
        Permission.REPORTS_READ,
        Permission.REPORTS_RUN,
        Permission.REPORTS_EXPORT,
        Permission.SETTINGS_READ,
    ],
    "viewer": [
        Permission.USERS_READ,
        Permission.REPORTS_READ,
        Permission.SETTINGS_READ,
    ],
    "api": [
        Permission.API_KEYS_READ,
        Permission.API_KEYS_CREATE,
    ],
}


def has_permission(user_permissions: Set[str], required: str) -> bool:
    """Check if user has the required permission.

    Args:
        user_permissions: Set of permission strings the user has
        required: The required permission string

    Returns:
        True if user has permission, False otherwise
    """
    if Permission.ALL in user_permissions:
        return True

    # Check exact permission
    if required in user_permissions:
        return True

    # Check wildcard permissions (e.g., "users.*" matches "users.read")
    parts = required.split(".")
    for i in range(1, len(parts)):
        wildcard = ".".join(parts[:i]) + ".*"
        if wildcard in user_permissions:
            return True

    return False