# Copyright (c) 2017 CloudZero - ALL RIGHTS RESERVED - PROPRIETARY AND CONFIDENTIAL
# Unauthorized copying of this file and/or project, via any medium is strictly prohibited.
# Direct all questions to legal@cloudzero.com

"""
Contains sets of resources that we know how to support in CZRNs and CZRELs.

This allows us (among other things) to make sure we know which resources are public or cross-region.
"""

# Some services default to being cross-region, and their CZRNs may look different by default
CROSS_REGION_RESOURCES = {
    ('artifact', '*'),
    ('cloudfront', '*'),
    ('cloudwatch', 'dashboard'),
    ('cz-cloud-provider', 'account'),
    ('cz-cloud-provider', 'anonymous-user'),
    ('iam', '*'),
    ('route53', '*'),
    ('s3', '*'),
    ('sts', '*'),
    ('waf', '*'),
    ('securityhub', 'ruleset'),
    ('globalaccelerator', '*'),
    ('ecr-public', '*')
}

NO_REGION_RESOURCES = {
    ('cz-internet', '*'),
}

# Some services default to being public (outside account), and their CZRNs may look different by default
PUBLIC_RESOURCES = {
    ('cz-cloud-provider', 'network-service'),
    ('cz-cloud-provider', 'ipv4-address'),
    ('cz-cloud-provider', 'cloud-service'),
    ('cz-cloud-provider', 'region'),
    ('cz-cloud-provider', 'availability-zone'),
    ('cz-cloud-provider', 'anonymous-user'),
    ('cz-contact', '*'),
    ('cz-internet', '*'),
    ('health', '*'),
    ('elasticbeanstalk', 'solution-stack'),
    ('securityhub', 'ruleset'),
}

# Some resources have a specific prefix that can reveal its resource type
RESOURCE_TYPE_PREFIXES = {"i": "instance",
                          "vol": "volume",
                          "snap": "snapshot",
                          "ami": "image",
                          "o": "organization",
                          "ou": "organizational-unit",
                          "tgw": "transit-gateway"}

# some service types have one (and only one) resource type, we capture those here to help identify certain resources
SERVICE_TYPE_TO_RESOURCE_TYPE = {"s3": "bucket"}

# Some resources appear in records related to other services, map those back to the correct service type
RESOURCE_TYPE_SERVICE_TYPE_TRANSFORMS = {"transit-gateway": "ec2"}

# Snowflake needs to override the product code for CZRNs
SNOWFLAKE_SERVICE_TYPE_OVERRIDES = {
    "snowflakecompute": "compute",
    "snowflakestorage": "storage"
}


def is_cross_region_resource(service_type, resource_type):
    """
    Determine if a given service/resource is cross-region.

    Args:
        service_type: (str) - the service type to check
        resource_type: (str) - the resource type to check

    Returns:
        True if the service/resource is cross-region else False.
    """
    return _resource_in_set(CROSS_REGION_RESOURCES, service_type, resource_type)


def is_no_region_resource(service_type, resource_type):
    """
    Determine if a given service/resource is no-region.

    Args:
        service_type: (str) - the service type to check
        resource_type: (str) - the resource type to check

    Returns:
        True if the service/resource is no-region else False.
    """
    return _resource_in_set(NO_REGION_RESOURCES, service_type, resource_type)


def is_public_resource(service_type, resource_type):
    """
    Determine if a given service/resource has public ownership.

    Args:
        service_type: (str) - the service type to check
        resource_type: (str) - the resource type to check

    Returns:
        True if the service/resource is public else False.
    """
    return _resource_in_set(PUBLIC_RESOURCES, service_type, resource_type)


def _resource_in_set(resource_set, service_type, resource_type):
    if (service_type, '*') in resource_set:
        return True
    return (service_type, resource_type) in resource_set
