"""Workspace authorization for API-key management."""
from uuid import UUID

from src.core.exceptions import ForbiddenError, NotFoundError
from src.domain.api_keys.repository import ApiKeyRepository
from src.domain.workspaces.facades import WorkspaceFacadeImpl


class ApiKeyService:
    def __init__(self, repository: ApiKeyRepository, workspaces: WorkspaceFacadeImpl):
        self._repository = repository
        self._workspaces = workspaces

    async def _require_manager(self, workspace_id: UUID, user_id: UUID) -> None:
        if not await self._workspaces.check_permission(workspace_id, user_id, "public_api.manage"):
            raise ForbiddenError()

    async def create(self, workspace_id: UUID, user_id: UUID, name: str, permissions: list[str]):
        await self._require_manager(workspace_id, user_id)
        # An administrator cannot delegate a permission they do not themselves hold.
        for permission in permissions:
            if not await self._workspaces.check_permission(workspace_id, user_id, permission):
                raise ForbiddenError("Cannot grant the requested API-key permissions")
        return await self._repository.create(
            workspace_id=workspace_id, created_by=user_id, name=name, permissions=permissions,
        )

    async def list_for_workspace(self, workspace_id: UUID, user_id: UUID):
        await self._require_manager(workspace_id, user_id)
        return await self._repository.list_for_workspace(workspace_id)

    async def revoke(self, workspace_id: UUID, user_id: UUID, key_id: UUID) -> None:
        await self._require_manager(workspace_id, user_id)
        if not await self._repository.revoke(key_id, workspace_id):
            raise NotFoundError("API key not found")